SAP-C02 Continuous Improvement for Existing Solutions — Timed 15 Questions

Question 1

Match each AWS monitoring and logging service to its capability.

Accepted Answer

CloudWatch: Monitor and manage metrics, logs, and alarms. CloudWatch provides observability via metrics and logs (correct). GuardDuty detects threats with ML (correct). CloudTrail records API activity for auditing, not resource configuration changes, so B is incorrect. AWS Config tracks resource configuration changes, not API activity, so C is incorrect.

Answer

CloudTrail: Evaluate and track resource configuration changes

Answer

AWS Config: Record API activity for auditing and compliance

Question 2

A company uses Amazon ElastiCache for Redis to cache frequently accessed data. The cache cluster is a single node (cache.r5.large). Over time, the cache hit ratio has decreased, and the CPU utilization is consistently above 80%. What should a solutions architect do to improve performance?

Accepted Answer

Enable cluster mode and distribute the cache across multiple shards.. Enabling cluster mode distributes data across multiple shards, reducing CPU load on individual nodes and improving the cache hit ratio by allowing more efficient use of memory and processing. Option A is incorrect because reducing TTL would cause more cache misses, further degrading the hit ratio. Option B is incorrect because read replicas offload read traffic but do not reduce CPU utilization caused by high write activity or data management. Option C is incorrect because scaling up to a larger node type provides more resources but does not address the architectural limitation of a single node; the increased CPU utilization is due to the single node being overwhelmed, not just resource capacity.

Answer

Reduce the Time-to-Live (TTL) of cached objects.

Answer

Add a read replica to offload read traffic.

Answer

Scale up to a larger node type, such as cache.r5.xlarge.

Question 3

A company uses Amazon S3 to store critical data. They need to ensure that data is automatically replicated to another AWS Region for disaster recovery. Which configuration meets this requirement with minimal operational overhead?

Accepted Answer

Enable S3 Cross-Region Replication (CRR) on the source bucket.. S3 Cross-Region Replication (CRR) automatically replicates objects to a destination bucket in a different AWS Region, providing disaster recovery with minimal operational overhead. Option A is wrong because S3 Versioning alone does not replicate data. Option B is wrong because S3 Transfer Acceleration speeds up uploads but does not replicate data. Option C is wrong because S3 Lifecycle policies manage storage tiers, not replication.

Answer

Enable S3 Versioning on the source bucket.

Answer

Use S3 Transfer Acceleration to upload objects to both Regions.

Answer

Configure an S3 Lifecycle policy to transition objects to S3 Glacier.

Question 4

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an S3 bucket. The ECS task role has the necessary S3 permissions. However, the application is unable to upload files to S3. What is the MOST likely cause?

Accepted Answer

The task definition does not specify the correct task role ARN. For an ECS Fargate task to access S3, the task role with the necessary permissions must be specified in the task definition. If the task role ARN is incorrect or missing, the container will not be able to assume the role, causing S3 access failures. Option A is wrong because the task execution role is used only by the ECS agent to pull container images and send logs, not for application-level S3 access. Option B is wrong because the question states that the task role already has the required S3 permissions, so the bucket policy is likely not the issue. Option C is wrong because an S3 VPC endpoint is not required if the task can reach S3 through the internet or a NAT gateway; its absence would not prevent uploads if proper routing exists.

Answer

The Task execution role is missing S3 permissions

Answer

The S3 bucket policy denies access to the task role

Answer

The VPC does not have an S3 VPC endpoint

Question 5

A company applies the above IAM policy to an IAM user. The user attempts to upload an object to my-bucket using the AWS CLI with the command: aws s3 cp file.txt s3://my-bucket/. What is the outcome?

Accepted Answer

The upload fails with an access denied error because the Deny statement with StringNotEquals blocks the request.. The Deny statement with StringNotEquals on s3:x-amz-server-side-encryption denies any PutObject that does not specify SSE-S3 (AES256). Since the CLI command does not include any encryption header, the Deny condition matches and the request is denied. Option A is incorrect because evaluation order does not matter; an explicit Deny always overrides an Allow. Option C is incorrect because the Allow statement requires encryption, which is not provided. Option D is incorrect because the Deny statement applies precisely when no encryption header is present.

Answer

The upload fails with an access denied error because the Deny statement is evaluated first.

Answer

The upload succeeds because the Allow statement matches.

Answer

The upload succeeds because the Deny statement does not apply when no encryption header is present.

Question 6

A company is designing a disaster recovery strategy for a multi-tier application hosted on AWS. The application uses Amazon RDS for MySQL with Multi-AZ deployment. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Configure a Cross-Region Read Replica of the RDS instance and promote it during disaster.. Configuring a Cross-Region Read Replica for RDS MySQL provides continuous replication with an RPO of seconds and failover can be accomplished in minutes by promoting the replica, meeting the 15-minute RTO and 1-hour RPO with minimal operational overhead. Option B is incorrect because AWS DMS adds complexity and overhead, and while it can replicate data, it is not as tightly integrated or automated as RDS Read Replicas. Option C is incorrect because restoring from hourly snapshots cannot achieve an RPO of 1 hour (it matches at best) and restore times typically exceed 15 minutes due to volume size, resulting in higher RTO. Option D is incorrect because Multi-AZ is designed for high availability within a single region, not for disaster recovery across regions; it does not provide cross-region failover capability.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to a standby RDS instance in another region.

Answer

Take automated snapshots every hour and copy them to another region. Restore from snapshot during disaster.

Answer

Use RDS Multi-AZ in a different region.

Question 7

A company runs a batch processing job on Amazon EC2 instances that are part of an Auto Scaling group. The job runs every night and takes approximately 2 hours. The instances are launched using a launch template with a Spot Instance request. Recently, the job has been failing because Spot Instances are being reclaimed before the job completes. The company wants a cost-effective solution that ensures the job completes reliably. The job can handle interruptions by checkpointing. Which solution should the company implement?

Accepted Answer

Use a mixed instances policy with a percentage of On-Demand Instances as a fallback.. The job uses checkpointing, so Spot Instances are suitable but risk premature termination. A mixed instances policy with a percentage of On-Demand Instances ensures reliability by providing a fallback when Spot capacity is reclaimed, without incurring the full cost of On-Demand-only or Reserved Instances.

Answer

Increase the instance size to complete the job faster.

Answer

Switch to On-Demand Instances only.

Answer

Use Reserved Instances for the batch job.

Question 8

A media company uses AWS CloudFront to distribute video content. They notice that some users in Europe experience high latency. CloudFront metrics show low cache hit ratios for European edge locations. The origin is an S3 bucket in us-east-1. What is the MOST effective optimization?

Accepted Answer

Add a second origin in eu-west-1 and configure origin groups with failover.. Configuring origin groups with a primary origin in us-east-1 and a secondary origin in eu-west-1 allows CloudFront to serve content from the closer origin for European users, reducing latency and improving cache hit ratios. Option A (Increase default TTL) would keep objects in cache longer but does not address the root cause of low cache hit ratios in European edge locations due to the distant origin. Option B (Add additional cache behaviors) allows different caching rules but does not reduce geographic latency. Option D (Enable S3 Transfer Acceleration) speeds up uploads to S3, not downloads or CloudFront delivery.

Answer

Increase the default TTL for objects in CloudFront.

Answer

Add additional cache behaviors for different file types.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 9

A healthcare company runs a HIPAA-compliant web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS for PostgreSQL database with Multi-AZ. The security team requires that all data in transit be encrypted using TLS 1.2 or higher. The current setup uses an SSL certificate on the ALB to terminate HTTPS, but traffic between the ALB and EC2 instances is over HTTP. The company wants to enforce end-to-end encryption without changing the application code. Which solution meets these requirements?

Accepted Answer

Configure the ALB to use a TLS listener and forward traffic to the target group using the TCP protocol on port 443.. By configuring the ALB with a TLS listener (HTTPS) and forwarding traffic to the target group using the HTTPS protocol on port 443, the traffic between ALB and EC2 instances is encrypted. This provides end-to-end encryption without changing application code, as the instances only need a valid certificate and web server configuration for HTTPS (which is a configuration change, not code).

Option A is incorrect because an NLB with a TLS listener terminates TLS at the NLB and forwards unencrypted traffic to targets via TCP, breaking end-to-end encryption. Health checks over HTTPS would require instances to handle HTTPS, which may need application changes.

Option C is incorrect because AWS Certificate Manager (ACM) does not accept self-signed certificates for trust; it requires certificates signed by a trusted certificate authority.

Option D is incorrect because traffic between CloudFront and ALB remains unencrypted (HTTP), and ALB to instances is also HTTP, so end-to-end encryption is not achieved.

Answer

Replace the ALB with a Network Load Balancer, configure a TLS listener, and use target group health checks over HTTPS.

Answer

Install a self-signed certificate on each EC2 instance, configure the ALB target group to use HTTPS, and upload the self-signed certificate to AWS Certificate Manager (ACM) for the ALB to trust.

Answer

Place AWS CloudFront in front of the ALB and configure CloudFront to use TLS 1.2, with the ALB still using HTTP.

Question 10

Refer to the exhibit.

$ aws ec2 describe-instances --region us-east-1 --filters Name=tag:Name,Values=WebServer --query 'Reservations[].Instances[].{ID:InstanceId,State:State.Name,Type:InstanceType,LaunchTime:LaunchTime}' --output table

A DevOps engineer runs the above command. The Auto Scaling group for WebServer instances has a desired count of 3, but the engineer notices that there are 5 instances with the same tag. What is the MOST likely cause?

Accepted Answer

The command is filtering by the wrong tag key.. The command filters by tag:Name=WebServer, but if the engineer notices 5 instances with the same tag, it indicates that the tag key used in the filter might be incorrect. For example, if some instances have the tag 'Name' incorrectly capitalized or a different tag key, they would not be matched by the filter. However, the engineer sees 5 instances, meaning the filter returns those 5, but the ASG desired count is 3. The most likely explanation is that the filter is matching instances that are not part of the ASG because they have a different tag key that coincidentally matches the filter. Option C is incorrect because instances in 'terminating' state are still returned by the describe-instances command, so they would appear in the output. Options A and D are less likely: cooldown does not prevent termination, and instances launched with a different launch template could still have the same tag.

Answer

The Auto Scaling group has a cooldown period that prevents immediate termination.

Answer

The other two instances are in a 'terminating' state and are not returned by the command.

Answer

The instances were launched with a different launch template that does not have the tag.

Question 11

A company uses AWS CloudFormation to deploy infrastructure. A recent deployment failed with a stack update error. The error message indicates that a resource was being updated but was in a failed state. What should the engineer do to resolve this issue?

Accepted Answer

Roll back the stack update to the previous working state.. Rolling back the stack update returns the stack to its last known stable state, which is the recommended approach when a resource update fails. Option A is incorrect because deleting the stack removes all resources and recreating from scratch is unnecessary and causes downtime. Option C is incorrect because CloudFormation does not support skipping a failed resource during an update; you must roll back to resolve the failure. Option D is incorrect because creating a new stack and migrating resources is complex, risky, and not aligned with CloudFormation's built-in rollback capability.

Answer

Delete the stack and recreate it with the same template.

Answer

Continue the update by skipping the failed resource.

Answer

Create a new stack and migrate resources.

Question 12

A company has an Amazon S3 bucket that stores sensitive data. The company wants to ensure that all data in the bucket is encrypted at rest. Which action should the Solutions Architect take?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3, SSE-KMS, or SSE-C.. Enabling default encryption on the S3 bucket ensures all objects are automatically encrypted at rest using SSE-S3, SSE-KMS, or SSE-C. Option B is wrong because AWS CloudHSM is a hardware-based key management service, but it is not required for encrypting data at rest in S3; default encryption or bucket policies can enforce encryption without CloudHSM. Option C is wrong because a bucket policy can deny uploads of unencrypted objects, but it does not encrypt existing data; it only enforces encryption for new uploads. Option D is wrong because pre-signed URLs grant temporary access to upload objects but do not enforce encryption; encryption must be enforced separately.

Answer

Use AWS CloudHSM to manage encryption keys.

Answer

Configure a bucket policy that denies unencrypted uploads.

Answer

Require the use of pre-signed URLs for uploads.

Question 13

A company runs a web application on EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon ElastiCache Redis cluster. During a traffic spike, the Redis cluster's CPU utilization reaches 90%, causing increased latency. The company wants to reduce the load on Redis without changing the application code. Which solution should the company implement?

Accepted Answer

Enable cluster mode on the ElastiCache Redis cluster to distribute data across multiple shards.. Enabling cluster mode on the ElastiCache Redis cluster distributes data across multiple shards, reducing CPU load per node and improving performance during traffic spikes. Option B is incorrect because Amazon ElastiCache Global Datastore is designed for cross-region disaster recovery and read scaling, not for reducing CPU load on a single cluster. Option C is incorrect because adding read replicas primarily offloads read traffic; if the CPU is saturated due to write operations, replicas do not help. Option D is incorrect because while upgrading to a larger node type can provide more CPU capacity, it is often less cost-effective than cluster-mode sharding, and the question asks for a solution that reduces load without changing application code—cluster mode meets this requirement without code changes.

Answer

Use Amazon ElastiCache Global Datastore to distribute traffic across regions.

Answer

Add read replicas to the Redis cluster to offload read traffic.

Answer

Upgrade to a larger Redis node type with more vCPUs.

Question 14

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of user_id and a sort key of timestamp. During a new game launch, the table experiences throttling on a few partitions. The company wants to improve the partition distribution. Which TWO actions should the company take? (Choose two.)

Accepted Answer

Add a random suffix to the partition key to distribute writes more evenly.. Adding a random suffix to the partition key distributes write traffic across multiple partitions, reducing hot partitions. Option D is correct because implementing write sharding with a composite partition key (e.g., combining user_id with a shard identifier) spreads writes across many partitions, improving distribution. Option B is incorrect because DAX (DynamoDB Accelerator) is a read cache; it does not affect write partitioning or distribution. Options C and E are incorrect: increasing read capacity units does not resolve write throttling, and switching to on-demand capacity mode does not inherently improve partition distribution.

Answer

Use DAX (DynamoDB Accelerator) to cache read-heavy workloads.

Answer

Increase the read capacity units for the table.

Answer

Switch the table to on-demand capacity mode.

Question 15

A company uses Amazon DynamoDB for a gaming application. During a new game launch, they experience higher than expected latency on write operations. The table has on-demand capacity. What is the best way to improve write performance?

Accepted Answer

Use auto scaling with provisioned capacity.. To improve write performance on a DynamoDB table with on-demand capacity, switching to provisioned capacity with auto scaling allows you to pre-configure higher write throughput, reducing latency during traffic spikes. On-demand capacity may have per-partition throughput limits and slower scaling for sudden bursts. DAX (option B) is a read cache and does not accelerate writes. Option C (increase WCU) is only applicable to provisioned capacity, not on-demand. Adding a GSI (option D) adds write overhead, degrading write performance.

Answer

Enable DynamoDB Accelerator (DAX) for caching.

Answer

Increase the write capacity units (WCU).

Answer

Add a global secondary index (GSI) to the table.