SAP-C02 Continuous Improvement for Existing Solutions Practice Test 9 — 15 Questions

Question 1

A company uses Amazon S3 to store critical data. They need to ensure that data is encrypted at rest. Which TWO methods can achieve this?

Accepted Answer

Use AWS KMS (SSE-KMS). Options D and E are correct. Both SSE-KMS (AWS KMS) and SSE-S3 (S3-Managed Keys) are server-side encryption options that encrypt data at rest in Amazon S3. Option A (SSL/TLS) encrypts data in transit, not at rest. Option B (bucket policy) controls access permissions but does not provide encryption. Option C (client-side encryption) would encrypt data before sending to S3, but it is not an AWS-managed service and requires client-side implementation; the question focuses on encryption at rest provided by AWS.

Answer

Enable SSL/TLS for the S3 bucket

Answer

Configure a bucket policy to enforce encryption

Answer

Use client-side encryption

Question 2

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to example-bucket with SSE-S3 (AES256) encryption. What will happen?

Accepted Answer

The upload fails because the Deny statement explicitly denies it. The Deny statement explicitly denies s3:PutObject when the encryption is not aws:kms. Since the user uses SSE-S3 (AES256), the condition 'StringNotEquals' evaluates to true (AES256 != aws:kms), so the Deny applies and the request is denied. Option B is incorrect because even if there is no explicit Allow, a Deny overrides any implicit allow. Options C and D are incorrect because the Deny overrides any Allow statement, and the Allow statement in the policy is for GetObject, not PutObject.

Answer

The upload fails because there is no explicit Allow for PutObject

Answer

The upload succeeds because the Allow statement permits it

Answer

The upload succeeds because SSE-S3 is allowed by the first statement

Question 3

Refer to the exhibit. A solutions architect runs the AWS CLI command to check the state of an EC2 instance. The output shows the instance is running. However, the application team reports that the instance is unreachable over SSH. What is the MOST likely cause?

Accepted Answer

A security group rule blocks inbound SSH traffic. The instance state is 'running', so it is not stopped or terminated. The most likely cause for being unreachable over SSH is that a security group rule blocks inbound SSH traffic (port 22). Option B is correct. Option A is wrong because the query is for the correct instance. Option C is wrong because the instance is running. Option D is wrong because EBS optimization does not affect network connectivity.

Answer

The CLI command is querying the wrong instance

Answer

The instance is in a 'stopped' state

Answer

The instance does not have EBS optimization enabled

Question 4

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket with versioning enabled and a DeletionPolicy of Retain. The stack is deleted. What happens to the bucket and its objects?

Accepted Answer

The bucket and its objects are retained. When a CloudFormation stack is deleted, the resource with DeletionPolicy set to Retain is preserved. Since the S3 bucket has DeletionPolicy: Retain, the bucket and all its objects (including versioned objects) are retained. Option A is incorrect because the bucket is not deleted. Option C is incorrect because DeletionPolicy overrides stack deletion behavior regardless of contents. Option D is incorrect because versioning information is also retained along with the bucket.

Answer

The bucket and all its objects are deleted

Answer

The bucket is deleted only if it is empty

Answer

The bucket is deleted, but versioning information is retained

Question 5

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB target group health checks are failing. Which step is MOST likely to resolve the issue?

Accepted Answer

Increase the health check timeout and decrease the unhealthy threshold.. Increasing the health check timeout gives instances more time to respond before being marked unhealthy, and decreasing the unhealthy threshold allows more consecutive failed health checks before considering an instance unhealthy, reducing false positives. Option A is incorrect because changing the protocol does not address the underlying cause of health check failures; it might even fail if the application does not support HTTPS. Option B is incorrect because using a Network Load Balancer does not resolve health check failures; NLB health checks are different but still need proper configuration. Option C is incorrect because simply increasing the number of instances does not fix the health check issue; instances may still fail health checks if they are not healthy.

Answer

Change the health check protocol from HTTP to HTTPS.

Answer

Use a Network Load Balancer instead of ALB.

Answer

Increase the number of instances in the target group.

Question 6

A company uses AWS CloudFormation to deploy a multi-tier application. The stack fails to update due to a resource conflict. The operations team needs to identify the resource causing the failure and modify the template to allow the update. Which approach is MOST effective?

Accepted Answer

Create a Change Set for the stack to preview the changes and identify the conflict.. A Change Set allows you to preview the changes that will be made during a stack update, including any potential errors or resource conflicts, before executing the update. This helps identify the specific resource causing the failure. Option B is wrong because the Events tab shows past events but does not provide a preview of planned changes or conflicts. Option C is wrong because StackSets are used for deploying stacks across multiple accounts and regions, not for troubleshooting a single stack update. Option D is wrong because drift detection compares the current stack resources with the template to identify manual changes, not update conflicts.

Answer

Review the stack's 'Events' tab in the AWS Management Console to find the error message.

Answer

Use AWS CloudFormation StackSets to deploy the update across multiple accounts.

Answer

Run a drift detection operation on the stack to identify manual changes.

Question 7

A company wants to reduce costs for its Amazon RDS for MySQL database without affecting performance. The database is used by a read-intensive application. Which action should the company take?

Accepted Answer

Implement a Read Replica and direct read traffic to it.. Implementing a Read Replica allows offloading read traffic from the primary DB instance. This reduces the load on the primary, potentially enabling the use of a smaller instance size or lowering provisioned IOPS, thereby reducing costs without affecting performance for the read-intensive application. Option A is incorrect because Multi-AZ deployment adds a standby instance and synchronous replication, increasing costs without direct performance benefit. Option B is incorrect; upgrading to the latest generation instance type may improve performance but generally does not reduce costs. Option D is incorrect; purchasing Reserved Instances provides a discount on hourly rates but does not address the utilization or instance size, so it does not directly reduce costs based on workload.

Answer

Change the DB instance to a Multi-AZ deployment.

Answer

Upgrade to the latest generation instance type.

Answer

Purchase Reserved Instances for the database.

Question 8

A company has a serverless application using AWS Lambda and Amazon API Gateway. The application experiences cold starts that cause latency spikes. Which solution would reduce the impact of cold starts?

Accepted Answer

Configure Provisioned Concurrency for the Lambda function.. Provisioned Concurrency keeps a specified number of execution environments initialized and ready to respond immediately, eliminating cold starts for the configured concurrency level. Option B (increasing memory) can reduce cold start duration but does not eliminate it. Option C (decreasing timeout) does not affect cold starts. Option D (enabling VPC access) typically adds network latency and may worsen cold starts due to ENI creation.

Answer

Increase the Lambda function memory allocation.

Answer

Decrease the Lambda function timeout.

Answer

Use a VPC and enable Lambda to access resources in the VPC.

Question 9

A company has a hybrid architecture with an AWS Direct Connect connection to its on-premises data center. The company wants to improve network availability and ensure that if the Direct Connect fails, traffic automatically uses a VPN backup. Which configuration should the company implement?

Accepted Answer

Configure a Direct Connect gateway and attach a VPN to it, then advertise the same prefixes via BGP with lower priority on the VPN.. AWS VPN CloudHub provides a hub-and-spoke model for multiple VPN connections, but for failover, using BGP with Direct Connect and VPN as backup is standard. However, the best answer is to use a Direct Connect gateway with a VPN attachment for failover. Option A is wrong because it adds latency. Option C is wrong because it bypasses Direct Connect. Option D is wrong because it does not provide automatic failover.

Answer

Use a NAT gateway to route traffic through the internet as a backup.

Answer

Create a Site-to-Site VPN connection and update route tables to point all traffic to the VPN.

Answer

Set up a second Direct Connect connection from a different provider.

Question 10

A DevOps team wants to automatically enforce tagging standards on all AWS resources created in an account. If a resource is created without the required tags, the team wants to prevent the creation or remediate it. Which AWS service should the team use?

Accepted Answer

AWS Config. AWS Config can evaluate resource compliance using managed rules (e.g., required-tags) and automatically remediate non-compliant resources via AWS Config remediation actions or AWS Systems Manager Automation. Option B is incorrect because AWS Organizations manages organizational units and service control policies, not resource-level tag enforcement. Option C is incorrect because IAM controls permissions, not tagging standards. Option D is incorrect because AWS Resource Groups & Tag Editor helps manage tags but does not prevent or auto-remediate non-compliant resource creation.

Answer

AWS Organizations

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Resource Groups & Tag Editor

Question 11

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences intermittent timeouts when calling an external API. The ECS tasks are in a private subnet with a NAT gateway. How can the company improve the reliability of outbound traffic?

Accepted Answer

Deploy a NAT gateway in each Availability Zone and update the route tables.. A NAT Gateway in each AZ provides high availability; without it, a single NAT Gateway failure causes timeouts. Option A is wrong because it reduces security. Option C is wrong because it does not address NAT redundancy. Option D is wrong because it adds complexity without directly fixing NAT issues.

Answer

Place the tasks in a public subnet with auto-assign public IP.

Answer

Increase the NAT gateway's bandwidth by using a larger instance type.

Answer

Use AWS Transit Gateway to route traffic through a central VPC.

Question 12

A company receives a Trusted Advisor recommendation to reduce costs by deleting unused Amazon EBS snapshots. The company has hundreds of snapshots. Which approach should the company use to identify and delete snapshots that are no longer needed?

Accepted Answer

Use AWS Backup to manage snapshots and set retention rules.. AWS Backup provides lifecycle policies and centralized snapshot management, making it easy to identify and automatically delete unused snapshots. Option A is incorrect because detailed billing reports show cost data but do not help identify which specific snapshots are unused. Option B is incorrect because manually checking each snapshot with the AWS CLI is not scalable for hundreds of snapshots. Option D is incorrect because Amazon S3 Lifecycle policies manage S3 objects, not EBS snapshots.

Answer

Enable detailed billing reports and analyze costs.

Answer

Use the AWS CLI to list all snapshots and manually check each one.

Answer

Use Amazon S3 Lifecycle policies to expire snapshots automatically.

Question 13

A company uses Amazon S3 to store critical data. They need to ensure that data is encrypted at rest. Which TWO methods can achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 Versioning. (S3 Versioning) is correct because when enabled, it retains all versions of objects, allowing recovery of deleted or overwritten objects within a specified retention period. Combined with a lifecycle policy to expire old versions after 30 days, it meets the requirement. Option B (S3 Server Access Logging) is used for auditing access, not for data recovery. Option C (S3 Object Lock in governance mode) prevents object deletion or overwrites by enforcing retention settings, but it is designed for compliance and does not inherently allow recovery of already deleted objects unless combined with versioning. Option D (S3 Intelligent-Tiering) optimizes storage costs based on access patterns, not for data protection or recovery.

Answer

S3 Server Access Logging

Answer

S3 Object Lock in governance mode

Answer

S3 Intelligent-Tiering

Question 14

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by external partners. The company will use a Network Load Balancer (NLB) to distribute traffic to EC2 instances. Which TWO actions should the company take to provide static IP addresses for the partners to whitelist?

Accepted Answer

Assign Elastic IP addresses to the Network Load Balancer.. You can assign Elastic IP addresses to the Network Load Balancer per Availability Zone, providing static IPs for external partners to whitelist. Option E is correct because AWS Global Accelerator provides two static IP addresses (or allows you to bring your own) and can be used with an NLB as an endpoint, offering static IPs that partners can whitelist. Option A is incorrect because attaching Elastic IPs to EC2 instances does not provide static IPs for the NLB frontend; the NLB uses its own IPs. Option C is incorrect because an Application Load Balancer (ALB) does not support static IP addresses by default and operates at layer 7, not suitable for this requirement. Option D is incorrect because AWS WAF is a web application firewall that filters traffic based on rules but does not provide static IP addresses for the load balancer.

Answer

Attach an Elastic IP to each EC2 instance.

Answer

Configure an Application Load Balancer instead of NLB.

Answer

Use AWS WAF to allow traffic from the partners' IP ranges.

Question 15

A company has a production AWS account with multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The firewall must be able to process traffic, and the solution must be highly available. Which THREE steps should the company take?

Accepted Answer

Attach Elastic Network Interfaces (ENIs) of the firewall instances to the inspection VPC subnets.. Options A, C, and E are correct. A: Attaching ENIs of firewall instances to the inspection VPC subnets allows traffic to be forwarded to the firewall for inspection. C: Deploying the firewall appliance as an EC2 instance in each AZ with auto scaling groups ensures high availability and scalability. E: Creating a dedicated inspection VPC with firewall instances in different Availability Zones centralizes inspection and provides fault tolerance. Option B is incorrect because propagating routes directly between VPCs would bypass the inspection firewall. Option D is incorrect because using a single route table in the Transit Gateway would not allow for selective routing to the inspection VPC and limits high availability.

Answer

Configure the Transit Gateway to propagate routes directly between VPCs.

Answer

Use a single route table in the Transit Gateway for all VPC attachments.