PAS-C01 Practice Test 2 — 25 Questions

Question 1

A company is migrating a web application to AWS and wants to use a blue/green deployment strategy to minimize downtime. Which AWS service should be used to route traffic between the blue and green environments?

Accepted Answer

Amazon Route 53. Amazon Route 53 is correct because it supports weighted DNS routing, which allows you to shift traffic gradually between blue and green environments by adjusting the weight values for DNS records. This enables a blue/green deployment strategy with minimal downtime, as Route 53 can route a percentage of traffic to the new environment while keeping the old environment active for rollback.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

Application Load Balancer (ALB)

Question 2

An organization is migrating a large data lake (500 TB) from on-premises HDFS to Amazon S3. The migration must be completed within 3 weeks. The network bandwidth between on-premises and AWS is 1 Gbps. What is the MOST efficient migration approach?

Accepted Answer

Use multiple AWS Snowball Edge devices to transfer the data in parallel.. Given the 500 TB data volume and a 3-week deadline, the 1 Gbps network bandwidth yields a theoretical maximum transfer of only ~340 TB in 3 weeks (1 Gbps * 21 days * 86400 seconds / 8 bits per byte), which is insufficient. AWS Snowball Edge devices provide a petabyte-scale, offline data transfer solution that bypasses network constraints entirely, allowing parallel transfers to meet the timeline. This is the most efficient approach because it avoids network bottlenecks and leverages physical shipping for massive datasets.

Answer

Use AWS DataSync over the existing internet connection.

Answer

Order a dedicated AWS Direct Connect circuit at 10 Gbps and use AWS DataSync.

Answer

Use Amazon S3 Transfer Acceleration to speed up the transfer over the internet.

Question 3

A company is migrating a multi-tier application to AWS and wants to ensure high availability. The application has a web tier, application tier, and database tier. The database is currently running on a single on-premises server. Which migration strategy minimizes downtime and provides the HIGHEST availability for the database tier?

Accepted Answer

Use AWS DMS to migrate the database to Amazon RDS Multi-AZ deployment.. Option C is correct because AWS DMS can perform a live migration with minimal downtime by continuously replicating changes from the source database to the target Amazon RDS Multi-AZ deployment. Multi-AZ provides automatic failover to a standby replica in a different Availability Zone, ensuring the highest availability for the database tier. This combination minimizes downtime during migration and provides built-in high availability post-migration.

Answer

Use AWS Database Migration Service (DMS) to migrate to Amazon RDS in a single-AZ deployment, then manually take snapshots.

Answer

Migrate the database to a single large Amazon EC2 instance using AWS Application Migration Service.

Answer

Migrate to Amazon RDS with Multi-AZ deployment and use DMS for initial load.

Question 4

A company is migrating a legacy application to AWS. The application currently uses Oracle Database and the company wants to migrate to Amazon Aurora PostgreSQL with minimal downtime. Which TWO steps should be taken to achieve this? (Choose TWO)

Accepted Answer

Use the AWS Schema Conversion Tool (SCT) to convert the Oracle schema to PostgreSQL.. Option A is correct because the AWS Schema Conversion Tool (SCT) can automatically convert Oracle database schemas (including stored procedures, views, and data types) to a PostgreSQL-compatible format, which is essential when migrating to Amazon Aurora PostgreSQL. Option D is correct because AWS DMS with ongoing replication (change data capture) allows you to keep the source Oracle database and target Aurora PostgreSQL synchronized with minimal downtime, enabling a near-zero-downtime migration by capturing and applying incremental changes.

Answer

Rehost the Oracle database on an Amazon EC2 instance to minimize changes.

Answer

Configure Amazon Aurora PostgreSQL with Multi-AZ for high availability.

Answer

Export Oracle database as dump files and import into Aurora PostgreSQL using native tools.

Question 5

A company is migrating a critical application to AWS using a phased approach. The application uses a custom Linux distribution that is not supported by AWS Application Migration Service. Which THREE steps should the company take to migrate the application? (Choose THREE)

Accepted Answer

Use AWS Server Migration Service (SMS) to replicate the on-premises server to AWS.. AWS Server Migration Service (SMS) is the correct choice because it is an agentless service that can replicate on-premises servers running custom Linux distributions as long as they are supported by the underlying hypervisor. SMS uses incremental replication to create Amazon Machine Images (AMIs) from the source server, enabling a lift-and-shift migration without requiring the application to be converted to a different OS. This approach directly addresses the scenario where AWS Application Migration Service does not support the custom Linux distribution.

Answer

Convert the application to run on Amazon Linux 2 to simplify future management.

Answer

Use AWS Database Migration Service (DMS) to migrate the application server.

Question 6

A team is migrating an Oracle database to Amazon RDS for MySQL using AWS DMS with ongoing replication (CDC). The initial load succeeded, but the CDC task fails with the error shown in the exhibit. The source Oracle database is on-premises. Which action should the team take to resolve the issue?

Accepted Answer

Connect to the source Oracle database and enable full supplemental logging by executing the command: ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;. AWS DMS requires full supplemental logging on the source Oracle database to capture all column values for CDC (ongoing replication). Without it, DMS cannot reconstruct the complete row changes from the redo logs, causing the CDC task to fail. Enabling full supplemental logging with `ALTER DATABASE ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;` ensures that every column is logged, allowing DMS to replicate all changes correctly.

Answer

Configure binary logging on the target MySQL RDS instance.

Answer

Stop and restart the DMS task to clear the error.

Answer

Switch the target database to Amazon RDS for Oracle to maintain compatibility.

Question 7

You are an AWS administrator for a company running SAP S/4HANA on AWS. The system uses a three-tier architecture: web dispatchers, application servers, and a HANA database. All components are in a single VPC. Security requirements demand that the web dispatchers are in a public subnet, application servers in private subnets, and the database in a private subnet. The web dispatchers need to communicate with the application servers on port 443, and application servers communicate with the database on port 31341. You have configured security groups accordingly. However, the web dispatchers cannot connect to the application servers. The network ACL for the public subnet allows inbound HTTPS from the internet and outbound all traffic. The private subnet NACL allows inbound HTTPS from the public subnet and outbound all traffic. The security group for the web dispatchers allows outbound HTTPS to the application security group. The application security group allows inbound HTTPS from the web security group. What is the issue?

Accepted Answer

The network ACL for the public subnet does not allow inbound ephemeral ports from the private subnet.. The issue is that network ACLs are stateless. The web dispatchers initiate outbound HTTPS connections to the application servers. The application servers respond using ephemeral ports. The public subnet NACL allows inbound HTTPS from the internet, but it does not allow inbound traffic on ephemeral ports from the private subnet. This blocks the return traffic. Therefore, option A is correct. Options B and C are incorrect because security groups are stateful and allow return traffic automatically. Option D is incorrect because the VPC's local route handles traffic between subnets.

Answer

The security group for the application servers does not allow inbound HTTPS from the web dispatchers.

Answer

The security group for the web dispatchers does not allow outbound HTTPS to the application security group.

Answer

The VPC does not have a route between the public and private subnets.

Question 8

A company is migrating a legacy application to AWS. The application requires a static IP address that does not change during instance stop/start. The application also needs to be highly available across two Availability Zones. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use a Network Load Balancer with an Elastic IP address. A Network Load Balancer (NLB) supports static IP addresses by allowing you to associate an Elastic IP address with each of its Availability Zone subnets. This provides a fixed entry point that does not change when backend instances are stopped or started, meeting the requirement for a static IP. Combined with an Auto Scaling group spanning two Availability Zones, the NLB ensures high availability by distributing traffic across healthy instances in both zones.

Answer

Place the instances in a placement group to ensure high availability

Answer

Use an Application Load Balancer to distribute traffic to the instances

Question 9

An SAP system running on AWS experiences periodic performance degradation. Analysis shows that the issue occurs when an on-premises monitoring system polls the SAP application server. Which AWS service can help mitigate this by caching or throttling requests?

Accepted Answer

AWS WAF. Option B (AWS WAF) is correct because AWS WAF can rate-limit incoming requests from specific IP addresses, reducing the load caused by frequent polling from the on-premises monitoring system. Option A (Amazon Route 53) is a DNS service and cannot throttle or cache application-level requests. Option C (Amazon CloudFront) caches content but is not designed for application-level throttling of requests to an SAP application server. Option D (Elastic Load Balancing) distributes traffic but does not provide request throttling or rate limiting.

Answer

Amazon Route 53

Answer

Amazon CloudFront

Answer

Elastic Load Balancing

Question 10

A company runs a production EC2 instance that experiences intermittent connectivity issues. The instance is part of an Auto Scaling group behind an Application Load Balancer. Which step should be taken FIRST to diagnose the issue?

Accepted Answer

Review CloudWatch metrics for the instance and the ALB target group. Reviewing CloudWatch metrics for the instance and the ALB target group is the correct first step because it provides immediate visibility into the root cause of intermittent connectivity issues. Metrics such as TargetResponseTime, RequestCount, and HealthyHostCount can reveal whether the problem is due to high latency, request failures, or the instance being marked unhealthy by the ALB health checks. This data-driven approach avoids unnecessary changes and aligns with the AWS Well-Architected Framework's principle of observability.

Answer

Modify the security group to allow all traffic temporarily

Answer

Terminate the instance and let Auto Scaling launch a new one

Answer

Attach an additional Elastic Network Interface (ENI) to the instance

Question 11

A company uses AWS Systems Manager Patch Manager to patch a fleet of EC2 instances. After a recent patching operation, some instances failed with the error 'Unable to retrieve patch baseline'. The instances are in a private subnet with a VPC endpoint for SSM. What is the MOST likely cause?

Accepted Answer

The VPC endpoint for SSM does not have a security group that allows HTTPS outbound to the endpoint. The error 'Unable to retrieve patch baseline' indicates that the EC2 instances cannot communicate with the AWS Systems Manager service to fetch the patch baseline configuration. Since the instances are in a private subnet with a VPC endpoint for SSM, the most likely cause is that the VPC endpoint's security group does not allow HTTPS outbound traffic (port 443) to the endpoint itself. Without this outbound rule, the SSM Agent on the instance cannot establish the TLS connection required to retrieve the patch baseline from the SSM API.

Answer

The CodeDeploy agent on the instances is outdated

Answer

The instances are not registered as managed instances with the SSM ManagedInstance role

Answer

The instances do not have an IAM instance profile attached

Question 12

A company uses AWS Config to record resource changes and evaluate rules. Recently, the compliance status of an S3 bucket rule changed from COMPLIANT to NON_COMPLIANT. The operations team investigates and finds that the bucket policy was modified. What is the MOST efficient way to identify who made the change and the exact time?

Accepted Answer

Search AWS CloudTrail event history for PutBucketPolicy events for the S3 bucket.. AWS CloudTrail captures all API calls made to AWS services, including S3 bucket policy modifications via the PutBucketPolicy API. By searching the CloudTrail event history for PutBucketPolicy events filtered by the specific S3 bucket ARN, you can directly identify the IAM user or role that made the change, along with the exact timestamp. This is the most efficient method because it provides a complete audit trail of API activity without requiring additional logging setup or parsing.

Answer

Examine the S3 server access logs for the bucket.

Answer

Review the configuration timeline in AWS Config for the S3 bucket.

Answer

Use AWS Systems Manager Automation to run a script that checks CloudWatch Logs.

Question 13

A company runs a critical application on an EC2 instance that uses a large EBS volume for database storage. The volume is not encrypted at rest. To meet compliance requirements, the company must enable encryption on the volume with minimal downtime. Which solution meets these requirements?

Accepted Answer

Take a snapshot of the volume with encryption enabled, create a new encrypted volume from the snapshot, detach the original volume, and attach the new volume. Option A is correct because taking a snapshot of the unencrypted volume with encryption enabled creates an encrypted snapshot. From that snapshot, you can create a new encrypted EBS volume. Detaching the original volume and attaching the new encrypted volume to the same EC2 instance achieves encryption with minimal downtime—only the brief period required for the detach/attach operations. This approach does not require copying the snapshot, which would add unnecessary time.

Answer

Use the AWS Management Console to modify the volume and enable encryption in place

Answer

Take a snapshot of the volume, copy the snapshot with encryption enabled, then restore to a new volume and attach it to the instance

Answer

Detach the volume, enable encryption using the ModifyVolume API, then reattach

Question 14

Solutions Architect needs to automate the patching of Amazon EC2 instances running Amazon Linux 2. The instances are in an Auto Scaling group and must be patched without downtime. Which approach is BEST?

Accepted Answer

Use AWS Systems Manager Patch Manager with a maintenance window and update the Auto Scaling group launch configuration to use a patched AMI for new instances.. Option C is correct because AWS Systems Manager Patch Manager automates patching of existing EC2 instances without downtime by using a maintenance window to schedule patch installation, and updating the Auto Scaling group launch configuration ensures new instances launched by the group use a patched AMI, maintaining consistency. This approach avoids terminating all instances at once (which would cause downtime) and leverages AWS-native automation for ongoing compliance.

Answer

Use Amazon Inspector to scan for vulnerabilities and automatically apply patches.

Answer

Terminate all instances and let the Auto Scaling group launch new instances from a patched AMI.

Answer

Create a custom AMI with latest patches and update the Auto Scaling group manually during a maintenance window.

Question 15

A DevOps engineer needs to automatically restart a specific service on an EC2 instance whenever the service crashes. The instance is running Amazon Linux 2. Which approach is the MOST operationally efficient?

Accepted Answer

Configure the service as a systemd unit with Restart=on-failure. Option C is correct because systemd, the default init system on Amazon Linux 2, provides a built-in `Restart=` directive that can be set to `on-failure`. This instructs systemd to automatically restart the service unit when it exits with a non-zero exit code or is terminated by a signal, without requiring any external monitoring or additional infrastructure. This is the most operationally efficient approach as it leverages the native service manager functionality with zero external dependencies.

Answer

Set up a CloudWatch alarm that triggers an SSM Run Command to restart the service

Answer

Write a cron job that checks the service status every minute and restarts it if needed

Answer

Use an AWS Lambda function that polls the service status and calls the EC2 reboot API

Question 16

A company runs a production application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group across three Availability Zones. The operations team notices that during a recent deployment, a small percentage of instances failed health checks and were replaced, causing a brief increase in error rates. What is the MOST effective way to reduce deployment-related errors?

Accepted Answer

Configure the Auto Scaling group with a warm-up time in the instance refresh settings.. Option C is correct because configuring a warm-up time in the Auto Scaling group's instance refresh settings ensures that newly launched instances are fully initialized and pass health checks before they start receiving traffic. This prevents brief error spikes during deployments by allowing instances to stabilize before being marked as healthy and added to the ALB target group.

Answer

Use a lifecycle hook to delay instance registration until a script completes.

Answer

Increase the health check interval on the ALB to reduce rapid replacements.

Answer

Increase the desired capacity of the Auto Scaling group to absorb failures.

Question 17

A company uses AWS Lambda functions with reserved concurrency to process messages from an SQS queue. The operations team notices that the Lambda function sometimes throttles, causing messages to remain in the queue. What is the MOST likely cause and solution?

Accepted Answer

The reserved concurrency is set too low; increase the reserved concurrency for the function.. Option D is correct because Lambda throttling occurs when the reserved concurrency limit is reached, preventing the function from processing new invocations. Since the function uses reserved concurrency, setting it too low restricts the number of concurrent executions, causing SQS messages to remain in the queue until concurrency becomes available. Increasing the reserved concurrency allows more parallel invocations, reducing throttling and improving message processing throughput.

Answer

The SQS visibility timeout is too short; increase it.

Answer

The Lambda function's dead-letter queue (DLQ) is not configured; set up a DLQ.

Answer

The SQS queue's redrive policy is too aggressive; reduce the maxReceiveCount.

Question 18

A DevOps engineer is troubleshooting an AWS CodePipeline that fails at the Deploy stage. The pipeline deploys a static website to an S3 bucket configured for website hosting. The error message indicates 'Access Denied' when the pipeline tries to upload files. Which IAM policy should be attached to the CodePipeline service role to resolve this?

Accepted Answer

A custom policy allowing s3:PutObject and s3:ListBucket on the target bucket.. The CodePipeline service role needs permissions to write objects to the S3 bucket and list its contents to verify the upload. A custom policy with s3:PutObject and s3:ListBucket on the target bucket grants exactly these required actions, resolving the 'Access Denied' error during the Deploy stage.

Answer

CloudFrontFullAccess

Answer

AdministratorAccess

Answer

AmazonS3ReadOnlyAccess

Question 19

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution requires the least operational overhead?

Accepted Answer

Create an SCP that denies s3:CreateBucket unless the request includes the CostCenter tag.. Option A is correct because a Service Control Policy (SCP) that denies s3:CreateBucket unless the request includes the CostCenter tag enforces tagging at the organization level, preventing any bucket creation without the required tag. This approach requires no ongoing maintenance, no additional services, and no per-account configuration, making it the least operational overhead solution.

Answer

Use AWS Config rules to detect untagged buckets and trigger a Lambda function to add tags.

Answer

Configure each account's S3 bucket creation process to include tagging.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Question 20

A company uses AWS CloudFormation to manage infrastructure. During an update, a stack fails to roll back and is left in UPDATE_ROLLBACK_FAILED state. The stack contains a DynamoDB table and a Lambda function. The operations team needs to fix the stack with minimal disruption. What should they do?

Accepted Answer

Use the ContinueUpdateRollback API to resume the rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED state, the recommended recovery action is to use the ContinueUpdateRollback API (or the AWS Management Console equivalent). This API instructs CloudFormation to skip the resources that failed to roll back and continue rolling back the remaining resources, bringing the stack to a consistent UPDATE_ROLLBACK_COMPLETE state. This approach minimizes disruption because it does not require deleting the stack or manually intervening with the DynamoDB table or Lambda function.

Answer

Manually delete the DynamoDB table and then retry the stack update.

Answer

Delete the stack and recreate it from the template.

Answer

Update the stack again with a different change set to bypass the failed resource.