PAS-C01 Technology Practice Test 2 — 15 Questions

Question 1

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must meet high availability and low latency requirements. The company expects traffic to spike unpredictably. Which THREE strategies should the company implement to ensure the application can handle the load? (Choose THREE.)

Accepted Answer

Enable API Gateway caching with a suitable TTL. Option A is correct because API Gateway caching stores responses from your endpoints, reducing the number of calls made to the backend Lambda function and DynamoDB. By setting a suitable TTL, you ensure that frequently accessed data is served from the cache, which lowers latency and offloads the backend during unpredictable traffic spikes. This directly supports high availability by preventing backend overload.

Answer

Set the Lambda function timeout to the maximum value of 15 minutes

Answer

Configure DynamoDB auto scaling with a minimum capacity of 10 read and 10 write capacity units

Question 2

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The application uses Auto Scaling and a MySQL RDS Multi-AZ DB instance. Users report intermittent connection timeouts, and CloudWatch metrics show CPUUtilization spikes to 90% on the DB instance. The application queries are read-heavy with occasional writes. What is the MOST cost-effective design change to improve performance?

Accepted Answer

Add an RDS read replica in the same region and configure the application to route read queries to the replica.. Option C is the most cost-effective design change because adding an RDS read replica offloads read-heavy queries from the primary DB instance, reducing CPU utilization without requiring a larger instance. Since the workload is read-heavy with occasional writes, a read replica handles SELECT traffic while the Multi-AZ primary manages writes, improving performance at a lower cost than scaling up.

Answer

Implement ElastiCache Redis cluster to cache query results and reduce DB load.

Answer

Enable RDS Performance Insights and create a CloudWatch alarm to reboot the DB instance on high CPU.

Answer

Switch the DB instance to a larger instance type to handle the load.

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets in the organization are encrypted with SSE-KMS using a specific KMS key. What is the MOST effective way to enforce this policy?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless the encryption settings include the specific KMS key.. Service control policies (SCPs) are the most effective way to enforce encryption requirements across all accounts in an AWS Organization because they act as a centralized guardrail that cannot be overridden by account administrators. By attaching an SCP to the root organizational unit that denies s3:PutBucketEncryption unless the request includes the specific KMS key ARN, the security team ensures that no bucket can be created or modified without the mandated encryption, regardless of IAM permissions within individual accounts.

Answer

Use AWS Config rules to detect noncompliant buckets and send notifications.

Answer

Create an IAM policy in each account that denies s3:PutBucketEncryption unless the correct KMS key is specified.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates all buckets with the required encryption.

Question 4

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 10 Gbps network connection to AWS. The migration must have minimal downtime. Which AWS service should be used for the initial data load?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication.. AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports a full load of the 2 TB Oracle database followed by continuous change data capture (CDC) to keep the target RDS instance synchronized with minimal downtime. The 10 Gbps network connection is sufficient for the initial load, and DMS handles schema conversion, data validation, and resumable transfers natively, making it ideal for a near-zero-downtime migration.

Answer

Amazon S3 Transfer Acceleration to upload the database dump, then restore to RDS.

Answer

AWS Storage Gateway to replicate the database files to Amazon S3, then restore to RDS.

Answer

AWS Snowball Edge to ship the data physically, then import to RDS.

Question 5

A company is deploying a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of EC2 instances in an Auto Scaling group, and an Amazon RDS MySQL Multi-AZ DB instance. The security team requires that all traffic between the ALB and EC2 instances is encrypted, and that the EC2 instances can only be accessed by the ALB. Which TWO steps should be taken to meet these requirements? (Choose TWO.)

Accepted Answer

In the EC2 security group, allow inbound traffic on port 443 from the ALB's security group.. Option C is correct because referencing the ALB's security group in the inbound rule of the EC2 security group ensures that only traffic originating from the ALB is allowed, meeting the requirement that EC2 instances can only be accessed by the ALB. Option D is correct because configuring the target group to use HTTPS protocol ensures that traffic between the ALB and EC2 instances is encrypted using TLS, satisfying the encryption requirement.

Answer

In the EC2 security group, allow inbound HTTPS traffic from 0.0.0.0/0.

Answer

Enable encryption at rest on the EC2 instances using EBS encryption.

Answer

Configure the ALB with an HTTPS listener and upload the SSL/TLS certificate.

Question 6

A company runs a production web application on AWS using an Application Load Balancer (ALB) with a target group of EC2 instances in an Auto Scaling group. The application uses a custom Amazon Machine Image (AMI) that includes the web server and application code. The Auto Scaling group has a launch template that references the AMI. The company updates the application code weekly and creates a new AMI version. The operations team manually updates the launch template to reference the new AMI and then initiates an instance refresh. Recently, a misconfiguration caused the launch template to point to an old AMI after an instance refresh, resulting in a rollback of the application code. The company wants to automate the deployment process to ensure that new AMIs are deployed consistently and safely. Which solution meets these requirements?

Accepted Answer

Use EC2 Image Builder to create and test the new AMI, then use AWS CodePipeline to automatically update the launch template and perform a rolling instance refresh.. Option A is correct because EC2 Image Builder automates the creation, testing, and validation of AMIs, ensuring only compliant images are produced. AWS CodePipeline can then automatically update the launch template with the new AMI ID and trigger a rolling instance refresh, eliminating manual steps and preventing misconfigurations like pointing to an old AMI.

Answer

Use AWS CodePipeline to run a script that updates the launch template with the new AMI ID and triggers an instance refresh.

Answer

Use AWS CloudFormation with a custom resource that validates the AMI and updates the Auto Scaling group.

Answer

Use AWS CodeDeploy to deploy the application code directly to the existing instances, bypassing the AMI update.

Question 7

A company is migrating a legacy three-tier web application to AWS. The application uses a MySQL database and stores session data in the database. The company wants to minimize database load and improve scalability. Which TWO actions should the company take to achieve these goals?

Accepted Answer

Use Amazon ElastiCache to store session data instead of the database.. Option C is correct because storing session data in the database creates unnecessary write load and latency. Amazon ElastiCache (Memcached or Redis) provides an in-memory key-value store that is ideal for transient session data, reducing database load and improving application scalability by offloading session management from the persistent MySQL layer.

Answer

Configure Amazon RDS Multi-AZ for high availability.

Answer

Use Auto Scaling for the web server tier to handle variable traffic.

Answer

Use Amazon RDS read replicas to offload read traffic from the primary database.

Question 8

A security engineer is troubleshooting an issue where a cross-account IAM role (arn:aws:iam::123456789012:role/CrossAccountRole) is unable to upload objects to an S3 bucket (my-bucket) owned by another account. The bucket policy is shown above. What is the MOST likely reason for the failure?

Accepted Answer

The IAM role does not specify the x-amz-acl header with value bucket-owner-full-control in its PutObject request.. The bucket policy grants s3:PutObject to the IAM role, but when objects are uploaded cross-account, the object ACL defaults to the uploading account's full control. Without the `x-amz-acl: bucket-owner-full-control` header, the bucket owner (target account) does not own the object and may not be able to manage or delete it. The IAM role must explicitly set this header in the PutObject request to transfer object ownership to the bucket owner, otherwise the upload fails with an AccessDenied error.

Answer

The S3 bucket has versioning enabled, which requires additional permissions.

Answer

The resource ARN in the bucket policy is incorrect; it should be arn:aws:s3:::my-bucket/*.

Answer

The bucket policy does not grant the s3:PutObject permission to the IAM role.

Question 9

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for PostgreSQL database. The operations team reports that the application becomes unresponsive for about 30 seconds every hour at the same time. The team checks the ALB access logs and notices that during the outage, the ALB returns HTTP 504 errors. The RDS monitoring shows a spike in CPU usage and active connections during the same period. The application team confirms there are no scheduled jobs during that time. What should the team do to diagnose the root cause?

Accepted Answer

Check the RDS Enhanced Monitoring metrics for the database instance to identify resource bottlenecks such as high memory pressure or disk I/O.. Option D is correct because the symptoms—hourly 30-second unresponsiveness, HTTP 504 errors from the ALB, and a correlated spike in RDS CPU and active connections—point to a database-side bottleneck. RDS Enhanced Monitoring provides OS-level metrics (memory, disk I/O, CPU) that can reveal resource contention or throttling events (e.g., swap usage, IOPS exhaustion) not visible in standard CloudWatch metrics, enabling precise root cause identification.

Answer

Review the security group rules for the database to ensure the application can connect.

Answer

Review the ALB target group health checks and ensure the EC2 instances are passing the health check.

Answer

Increase the EC2 instance size to handle more concurrent connections.

Question 10

Drag and drop the steps to migrate an on-premises SAP system to AWS using AWS Application Migration Service (MGN) into the correct order.

Question 11

Drag and drop the steps to set up an SAProuter connection between an on-premises network and AWS for SAP support access into the correct order.

Question 12

Drag and drop the steps to optimize SAP HANA performance by moving to an Amazon RDS for SAP HANA instance into the correct order.

Question 13

Match the AWS service to its primary use in an SAP environment.

Question 14

Match the AWS service to its role in SAP high availability.

Question 15

Match the AWS managed service to its SAP-related capability.