SAP-C02 Accelerate Workload Migration and Modernization Practice Test 13 — 15 Questions

Question 1

A company is migrating a legacy e-commerce platform to AWS. The platform includes a MySQL database that experiences heavy read traffic. The company wants to improve performance and reduce latency for read operations. Which TWO actions should the solutions architect take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add read replicas to the RDS MySQL database.. Adding read replicas offloads read traffic from the primary database, improving performance. Implementing Amazon ElastiCache for caching reduces database load for frequently accessed data. Multi-AZ is for high availability, not read performance. Provisioned IOPS improves write performance. Sharding adds complexity and may not be necessary.

Answer

Enable Multi-AZ on the RDS instance.

Answer

Shard the database across multiple RDS instances.

Answer

Upgrade to Provisioned IOPS for the database.

Question 2

A company is migrating a batch processing workload to AWS. The workload runs nightly and takes approximately 2 hours on a single on-premises server. The company wants to reduce the processing time to under 30 minutes. Which THREE steps should the solutions architect recommend?

Accepted Answer

Split the workload into smaller batches and run them in parallel on multiple EC2 instances.. Using a larger instance (compute optimized) can speed up processing. Parallel processing by splitting the workload across multiple EC2 instances reduces time. Using a distributed processing framework like AWS Batch with multiple compute environments enables parallel execution. EBS io2 volumes improve I/O but may not reduce time by 75%. Spot Instances can reduce cost but not processing time directly.

Answer

Use EBS io2 volumes with high IOPS for the instance.

Answer

Use EC2 Spot Instances to reduce cost.

Question 3

A company is migrating a web application to AWS and wants to use a microservices architecture. The application needs to communicate synchronously via REST APIs. Which TWO AWS services should the architect consider for implementing API communication?

Accepted Answer

Application Load Balancer. Amazon API Gateway is a fully managed service for creating RESTful APIs. AWS AppSync is for GraphQL. For internal microservice communication, API Gateway is suitable. Application Load Balancer can also route HTTP traffic to multiple services. NLB is for TCP/UDP. SQS is asynchronous. Step Functions orchestrate workflows.

Answer

AWS Step Functions

Answer

AWS AppSync

Answer

Amazon Simple Queue Service (Amazon SQS)

Question 4

A company is using AWS Migration Hub to track a server migration. The migration task has failed with the error shown in the exhibit. Which action should the solutions architect take to resolve the issue?

Accepted Answer

Ensure the source server's SSL certificate is signed by a trusted Certificate Authority (CA).. The error indicates that the SSL certificate of the source server is not trusted by the AWS Migration Hub or the migration tool (e.g., AWS MGN, CloudEndure). The solution is to ensure the source server has a valid SSL certificate from a trusted CA, or configure the migration tool to ignore certificate validation if appropriate. Increasing timeout or retrying will not fix the certificate issue. Changing port is not relevant. Using a different tool may bypass but does not address the root cause.

Answer

Change the migration port from 443 to 80.

Answer

Retry the migration using AWS CloudEndure instead of AWS MGN.

Answer

Increase the timeout value for the migration task.

Question 5

An IAM policy is attached to a role used by AWS DMS for a database migration from an RDS MySQL instance to an S3 bucket. The migration fails with an access denied error when writing to S3. Which missing permission is the most likely cause?

Accepted Answer

s3:PutObject. The policy allows s3:GetObject and s3:ListBucket, but not s3:PutObject, which is required for writing data to S3. The error is about writing, not reading. dms:StartReplicationTask is already allowed. rds:DescribeDBInstances is for reading RDS metadata. kms:Decrypt is only needed for encrypted buckets.

Answer

kms:Decrypt

Answer

rds:DescribeDBInstances

Answer

dms:StartReplicationTask

Question 6

A company is migrating a critical application to AWS using a lift-and-shift approach. The application runs on two on-premises servers: a web server and a database server running SQL Server. The company has deployed the web server on an EC2 instance behind an Application Load Balancer, and the database on an RDS for SQL Server Multi-AZ instance. After migration, users report that the application is noticeably slower compared to on-premises. The application uses a large number of database transactions, and latency between the web server and database has increased. The web server is in us-east-1a, and the RDS primary instance is in us-east-1b. The solutions architect verifies that the application is using the RDS endpoint, not the IP address. What should the architect do to reduce latency?

Accepted Answer

Move the web server EC2 instance to the same Availability Zone as the RDS primary instance.. Colocating the web server and RDS primary in the same Availability Zone minimizes network latency. RDS Multi-AZ automatically manages failover, and the web server should be in the same AZ as the primary to avoid cross-AZ latency. Enabling Multi-AZ on the web server does not help. Using a larger instance does not reduce latency. CloudFront is for content delivery, not database latency.

Answer

Enable Multi-AZ on the web server EC2 instance.

Answer

Upgrade the web server EC2 instance to a larger instance type with enhanced networking.

Answer

Deploy Amazon CloudFront in front of the web server to cache responses.

Question 7

A company is modernizing its application by migrating from a monolithic architecture to microservices on Amazon ECS Fargate. The application uses an on-premises Oracle database, which is being migrated to Amazon Aurora PostgreSQL as part of the modernization. The team has refactored the application into several microservices, each with its own database schema in the same Aurora cluster. During load testing, the team notices that one microservice's heavy write operations cause increased latency for other microservices' read queries. The Aurora cluster uses a single writer and multiple readers. The team needs to isolate the write-heavy microservice without changing the application code. What should the solutions architect do?

Accepted Answer

Create a separate Aurora cluster for the write-heavy microservice and point the microservice to that cluster.. Using a separate Aurora cluster for the write-heavy microservice physically isolates the workload, preventing impact on other microservices. The application code points to different cluster endpoints. Using a larger instance might help but does not isolate; read replicas do not help with write contention; RDS Proxy is for connection pooling, not isolation.

Answer

Use Amazon RDS Proxy to manage database connections.

Answer

Configure Aurora read replicas to offload read queries from the writer.

Answer

Increase the instance size of the Aurora writer to handle the write load.

Question 8

A company is migrating a legacy application to AWS and needs to ensure compliance with data residency requirements. The application stores personally identifiable information (PII) in an on-premises MySQL database. The company wants to encrypt the data at rest and in transit during the migration. The database will be migrated to Amazon RDS for MySQL. The solutions architect must ensure that all data is encrypted end-to-end. Which combination of steps will meet these requirements?

Accepted Answer

Enable RDS encryption at launch, enforce TLS for connections, and configure the application to use SSL/TLS.. To meet the requirements for encrypting data at rest and in transit end-to-end, the solution must include encryption for the RDS database at rest (only possible at launch) and encryption in transit for both the migration process and ongoing application connections. Option C correctly combines enabling RDS encryption at launch (for at-rest encryption), enforcing TLS for connections to the RDS endpoint (for in-transit encryption), and configuring the application to use SSL/TLS (ensuring the application sends encrypted traffic). Option A is incorrect because using a custom AMI with encrypted EBS applies to EC2 instances, not RDS; the database needs to be migrated to RDS, not EC2. Option B is partially correct but fails to include the application-side TLS configuration, so it does not ensure end-to-end encryption from the application to the database. Option D is incorrect because RDS encryption cannot be enabled after migration; it must be enabled at launch, and a VPN does not encrypt the database at rest.

Answer

Use a custom AMI with encrypted EBS volumes, enforce TLS, and use AWS DMS with SSL.

Answer

Enable RDS encryption at launch, use AWS DMS with SSL, and require SSL certificate verification on the RDS endpoint.

Answer

Enable RDS encryption after migration, use AWS DMS with SSL, and set up a VPN connection.

Question 9

A company is migrating a legacy .NET Framework 4.7 application to AWS. The application currently uses Windows Authentication and stores session state in-process. The company wants to minimize code changes and use AWS managed services. Which TWO strategies should the company adopt?

Accepted Answer

Migrate the application to run on Amazon EC2 instances joined to AWS Managed Microsoft AD.. AWS Managed Microsoft AD supports Windows Authentication and can integrate with EC2 without code changes. Option C is correct because ElastiCache for Redis can be used as a distributed session store, replacing in-process session state with minimal code changes (using Redis Session State Provider). Option B is wrong because .NET Core is not compatible with .NET Framework 4.7 without significant rewrite. Option D is wrong because Cognito is for external identity providers, not Windows Authentication. Option E is wrong because DynamoDB is not a drop-in replacement for in-process sessions; it requires custom code.

Answer

Rewrite the application to .NET Core and deploy on AWS Elastic Beanstalk with Amazon RDS for SQL Server.

Answer

Use Amazon Cognito with an Active Directory connector for authentication.

Answer

Use Amazon DynamoDB to persist session state.

Question 10

A company is migrating a 3-tier web application from on-premises to AWS. The application consists of a Linux Apache HTTP server, a Java application server (Tomcat), and a MySQL database. The company wants to use AWS managed services to reduce operational overhead. The migration plan includes using AWS Elastic Beanstalk for the web and application tiers, and Amazon RDS for MySQL for the database. During a test migration, the team notices that the application is experiencing intermittent connection timeouts when the web tier attempts to connect to the application tier. The web and application tiers are deployed in separate Elastic Beanstalk environments, both in the same VPC, same region, and same Availability Zone. The security groups allow traffic from the web tier to the application tier on port 8080. What is the MOST likely cause of the connection timeouts?

Accepted Answer

The web tier is trying to connect directly to the application tier instances, but the application tier's security group does not allow inbound traffic from the web tier's security group.. The most likely cause is that the web tier is configured to connect directly to the application tier instances rather than to the application tier's load balancer. In Elastic Beanstalk, each environment typically includes an Auto Scaling group and a load balancer. For the web tier to communicate with the application tier, it should connect to the application tier's load balancer DNS name. If the web tier attempts to connect directly to the application tier instances, the application tier's security group must allow inbound traffic from the web tier's security group. If that rule is missing or misconfigured, connections will time out. Option A is incorrect because DNS resolution for an internal ALB generally works within the same VPC. Option B is incorrect because both environments are in the same Availability Zone. Option D is incorrect because health check misconfiguration would affect the load balancer's routing, not cause direct connection timeouts between tiers.

Answer

The application tier is configured with an internal Application Load Balancer, but the web tier is unable to resolve the DNS name of the load balancer.

Answer

The web tier and application tier are in different Availability Zones, causing increased latency and timeouts.

Answer

The Elastic Beanstalk environment's health check URL is misconfigured, causing the instances to be marked as unhealthy and removed from the load balancer.

Question 11

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single Windows Server with IIS and SQL Server. The company wants to adopt a microservices architecture on AWS using containers. The development team has containerized the application into several Docker containers. The company needs a solution that minimizes operational overhead for managing the container orchestration and scaling, and also integrates with AWS services like IAM, CloudWatch, and VPC. Which AWS service should the company use to run the containers?

Accepted Answer

Amazon ECS with the Fargate launch type.. (Amazon ECS with the Fargate launch type) is correct because it provides serverless container orchestration, eliminating the need to manage underlying infrastructure, integrates natively with AWS services like IAM, CloudWatch, and VPC, and is ideal for microservices. Option B (EKS with managed node groups) still requires managing Kubernetes control plane and worker nodes, adding operational overhead. Option C (Elastic Beanstalk with Docker) is better suited for simpler, single-container deployments and lacks fine-grained control for microservices. Option D (EC2 instances with Docker and Auto Scaling) requires managing EC2 instances, patching, and scaling, increasing operational burden.

Answer

Amazon EKS with managed node groups.

Answer

AWS Elastic Beanstalk with a Docker platform.

Answer

Amazon EC2 instances with Docker installed, managed by an Auto Scaling group.

Question 12

A company is migrating a large-scale batch processing system from on-premises to AWS. The system processes hundreds of thousands of files daily, each file being a few MB in size. The files are received via SFTP and need to be processed within 4 hours. The company wants to use AWS services to build a fully managed, scalable, and cost-effective solution. The current on-premises system uses a single server with a scheduled task that processes files sequentially. The migration should improve throughput and reduce processing time. Which architecture should the company implement?

Accepted Answer

Use AWS Transfer Family for SFTP, store files in Amazon S3, configure an S3 event notification to publish messages to an Amazon SQS queue, and use an Auto Scaling group of EC2 instances to process messages from the queue.. It uses AWS Transfer Family for managed SFTP, stores files in S3, and then leverages S3 event notifications to send messages to an SQS queue. An Auto Scaling group of EC2 instances can then process messages from the queue, scaling based on queue depth (e.g., using CloudWatch alarms). This provides scalable, parallel processing, improving throughput over the on-premises sequential system. Option A is incorrect because AWS Batch with Fargate may incur higher costs for long-running jobs and is subject to concurrency limits. Option B is incorrect because AWS Lambda has a 15-minute timeout and is not suitable for files that may take longer to process, and also may not be cost-effective for high-volume processing. Option C is incorrect because a single EC2 instance processes sequentially, similar to on-premises, and does not improve throughput.

Answer

Use AWS Transfer Family for SFTP, store files in Amazon S3, and use AWS Batch with Fargate launch type to process files in parallel.

Answer

Use AWS Transfer Family for SFTP, store files in Amazon S3, and use AWS Lambda functions triggered by S3 events to process each file.

Answer

Use AWS Transfer Family for SFTP, store files in Amazon S3, and configure a single EC2 instance to poll S3 for new files and process them sequentially.

Question 13

A company is migrating a critical application from on-premises to AWS. The application uses a Microsoft SQL Server database with Always On Availability Groups for high availability. The company wants to use Amazon RDS for SQL Server to reduce management overhead. The database size is 500 GB. The migration must have minimal downtime and support transactional consistency. The company has a VPN connection to AWS. Which migration strategy should the company use?

Accepted Answer

Use AWS DMS with a full-load migration and ongoing replication from the on-premises SQL Server to RDS for SQL Server.. AWS DMS supports ongoing replication from SQL Server to RDS for SQL Server using native CDC capabilities, enabling minimal downtime. Option B is wrong because native backup/restore requires downtime and does not support ongoing replication. Option C is wrong because exporting data with SQL Server Import/Export Wizard requires downtime and does not support ongoing sync. Option D is wrong because SCT is for schema conversion, not data migration; also, the question states the database is SQL Server to RDS for SQL Server, so schema conversion is not needed.

Answer

Take a full backup of the database, restore it to RDS, and then schedule a final backup and restore after cutting over.

Answer

Use the SQL Server Import/Export Wizard to copy data from on-premises to RDS over the VPN.

Answer

Use AWS SCT to convert the database schema and then use AWS DMS for data migration.

Question 14

A company is migrating a web application from on-premises to AWS. The application consists of a stateless web tier and a stateful application tier that stores session data in a local file system. The company wants to use AWS Elastic Beanstalk for both tiers. During a test migration, the development team notices that users are being logged out intermittently. The application tier is configured with two EC2 instances behind an internal load balancer. What should the development team do to resolve the issue?

Accepted Answer

Move session storage to Amazon ElastiCache for Redis and configure the application to use it.. The issue is that session data is stored locally on each application instance. When traffic is distributed by the internal load balancer, subsequent requests from the same user may go to a different instance, losing the session data. The best practice is to use a centralized session store like Amazon ElastiCache for Redis. This ensures session data persists across all instances. Option A (sticky sessions) would cause load imbalance and is not recommended for high availability. Option C does not address session storage. Option D (DynamoDB) is possible but not as performant for session storage and requires more custom code; Redis is the recommended service for session management.

Answer

Enable sticky sessions (session affinity) on the application tier's load balancer.

Answer

Increase the number of instances in the web tier to reduce the load on the application tier.

Answer

Store session data in Amazon DynamoDB.

Question 15

A company is migrating a legacy application to AWS. The application uses a proprietary binary protocol that is not HTTP-based. The application currently runs on a single server and communicates with clients over TCP port 4444. The company wants to use AWS Elastic Load Balancing to distribute traffic across multiple EC2 instances for high availability. Which load balancer type should the company use?

Accepted Answer

Network Load Balancer (NLB). Network Load Balancer (NLB) operates at the transport layer (Layer 4) and supports TCP traffic, including proprietary protocols over port 4444. Option A is incorrect because AWS Global Accelerator uses anycast IP to improve performance but does not function as a regional load balancer; it is typically used with ALB or NLB. Option B is incorrect because Classic Load Balancer (CLB) is a legacy option that supports TCP but lacks advanced features and is not recommended for new applications. Option D is incorrect because Application Load Balancer (ALB) only supports HTTP/HTTPS and cannot handle non-HTTP traffic.

Answer

AWS Global Accelerator

Answer

Classic Load Balancer (CLB)

Answer

Application Load Balancer (ALB)