SAP-C02 practice questions 171–180

1. Question 171 · 527 in bank

   A company uses an Amazon Aurora PostgreSQL DB cluster for applications in a single AWS Region. The company's database team must monitor all data activity on all the databases. Which solution will achieve this goal?

   • ASet up an AWS Database Migration Service (AWS DMS) change data capture (CDC) task. Specify the Aurora DB cluster as the source. Specify Amazon Kinesis Data Firehose as the target. Use Kinesis Data Firehose to upload the data into an Amazon OpenSearch Service cluster for further analysis.
   • BStart a database activity stream on the Aurora DB cluster to capture the activity stream in Amazon EventBridge. Define an AWS Lambda function as a target for EventBridge. Program the Lambda function to decrypt the messages from EventBridge and to publish all database activity to Amazon S3 for further analysis.
   • CStart a database activity stream on the Aurora DB cluster to push the activity stream to an Amazon Kinesis data stream. Configure Amazon Kinesis Data Firehose to consume the Kinesis data stream and to deliver the data to Amazon S3 for further analysis.
   • DSet up an AWS Database Migration Service (AWS DMS) change data capture (CDC) task. Specify the Aurora DB cluster as the source. Specify Amazon Kinesis Data Firehose as the target. Use Kinesis Data Firehose to upload the data into an Amazon Redshift cluster. Run queries on the Amazon Redshift data to determine database activities on the Aurora database.

   Show answer

   Answer: C

   Explanation

   B is ans : Here's why this solution is the most suitable: Direct integration: Database activity streams natively integrate with EventBridge, streamlining the process of capturing and routing events. Rich event filtering: EventBridge offers powerful filtering capabilities, allowing the database team to selectively monitor specific events or patterns of interest. Flexible delivery: EventBridge can trigger various targets, including Lambda functions, which provide the ability to process and store events in S3 for further analysis. Serverless architecture: Lambda functions eliminate the need to manage servers, reducing operational overhead and scaling automatically to handle event volume. Cost-effective storage: S3 offers durable and cost-effective storage for long-term analysis of database activity logs.

   Source: Adapted from community discussion — duriselvan

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 172 · 527 in bank

   An entertainment company recently launched a new game. To ensure a good experience for players during the launch period, the company deployed a static quantity of 12 r6g.16xlarge (memory optimized) Amazon EC2 instances behind a Network Load Balancer. The company's operations team used the Amazon CloudWatch agent and a custom metric to include memory utilization in its monitoring strategy. Analysis of the CloudWatch metrics from the launch period showed consumption at about one quarter of the CPU and memory that the company expected. Initial demand for the game has subsided and has become more variable. The company decides to use an Auto Scaling group that monitors the CPU and memory consumption to dynamically scale the instance fleet. A solutions architect needs to configure the Auto Scaling group to meet demand in the most cost-effective way. Which solution will meet these requirements?

   • AConfigure the Auto Scaling group to deploy c6g.4xlarge (compute optimized) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
   • BConfigure the Auto Scaling group to deploy m6g.4xlarge (general purpose) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
   • CConfigure the Auto Scaling group to deploy r6g.4xlarge (memory optimized) instances. Configure a minimum capacity of 3, a desired capacity of 3, and a maximum capacity of 12.
   • DConfigure the Auto Scaling group to deploy r6g.8xlarge (memory optimized) instances. Configure a minimum capacity of 2, a desired capacity of 2, and a maximum capacity of 6.

   Show answer

   Answer: C

   Explanation

   C . From the question, app is running on memory-optimized instances (r6g.16xlarge) but only utilizing about one quarter of the CPU and memory. So cost-effective to use smaller instances (r6g.4xlarge), which provide a quarter of r6g.16xlarge instances.

   Source: Adapted from community discussion — bhanus

   Next question

3. Question 173 · 527 in bank

   A financial services company loaded millions of historical stock trades into an Amazon DynamoDB table. The table uses on-demand capacity mode. Once each day at midnight, a few million new records are loaded into the table. Application read activity against the table happens in bursts throughout the day. and a limited set of keys are repeatedly looked up. The company needs to reduce costs associated with DynamoDB. Which strategy should a solutions architect recommend to meet this requirement?

   • ADeploy an Amazon ElastiCache cluster in front of the DynamoDB table
   • BDeploy DynamoDB Accelerator (DAX). Configure DynamoDB auto scaling. Purchase Savings Plans in Cost Explorer.
   • CUse provisioned capacity mode. Purchase Savings Plans in Cost Explorer.
   • DDeploy DynamoDB Accelerator (DAX). Use provisioned capacity mode. Configure DynamoDB auto scaling.

   Show answer

   Answer: D

   Explanation

   DynamoDB Accelerator (DAX): This in-memory cache reduces read latency and improves read throughput for frequently accessed data. Since the application has burst read activity and repeatedly accesses a limited set of keys, DAX can significantly improve performance and reduce costs associated with read throughput on DynamoDB. Provisioned capacity mode: While on-demand capacity mode eliminates the need for upfront planning, it can be costly for applications with predictable workloads. Provisioned capacity allows for better cost optimization and predictability by specifying the minimum and maximum capacity required throughout the day. DynamoDB auto scaling: This feature automatically adjusts provisioned capacity based on actual usage patterns. This ensures that the table has sufficient capacity during peak hours while avoiding wasted resources during off-peak periods, further reducing costs.

   Source: Adapted from community discussion — duriselvan

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 174 · 527 in bank

   Select 2

   A company is creating a centralized logging service running on Amazon EC2 that will receive and analyze logs from hundreds of AWS accounts. AWS PrivateLink is being used to provide connectivity between the client services and the logging service. In each AWS account with a client, an interface endpoint has been created for the logging service and is available. The logging service running on EC2 instances with a Network Load Balancer (NLB) are deployed in different subnets. The clients are unable to submit logs using the VPC endpoint. Which combination of steps should a solutions architect take to resolve this issue? (Choose two.)

   • ACheck that the NACL is attached to the logging service subnet to allow communications to and from the NLB subnets. Check that the NACL is attached to the NLB subnet to allow communications to and from the logging service subnets running on EC2 instances.
   • BCheck that the NACL is attached to the logging service subnets to allow communications to and from the interface endpoint subnets. Check that the NACL is attached to the interface endpoint subnet to allow communications to and from the logging service subnets running on EC2 instances.
   • CCheck the security group for the logging service running on the EC2 instances to ensure it allows ingress from the NLB subnets.
   • DCheck the security group for the logging service running on EC2 instances to ensure it allows ingress from the clients.
   • ECheck the security group for the NLB to ensure it allows ingress from the interface endpoint subnets.

   Show answer

   Answer: AC

   Explanation

   When you associate a Network Load Balancer with an endpoint service, the Network Load Balancer forwards requests to the registered target. The requests are forwarded as if the target was registered by IP address. In this case, the source IP addresses are the private IP addresses of the load balancer nodes. If you have access to the Amazon VPC endpoint service, then verify that: The Inbound security group rules of the Network Load Balancer’s targets allow communication from the private IP address of the Network Load Balancer nodes The rules within the network ACL associated with the Network Load Balancer’s targets allow communication from the private IP address of the Network Load Balancer nodes https://repost.aws/knowledge-center/security-network-acl-vpc-endpoint

   Source: Adapted from community discussion — magmichal05

   References

   • repost.aws documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 175 · 527 in bank

   A company has millions of objects in an Amazon S3 bucket. The objects are in the S3 Standard storage class. All the S3 objects are accessed frequently. The number of users and applications that access the objects is increasing rapidly. The objects are encrypted with server-side encryption with AWS KMS keys (SSE-KMS). A solutions architect reviews the company’s monthly AWS invoice and notices that AWS KMS costs are increasing because of the high number of requests from Amazon S3. The solutions architect needs to optimize costs with minimal changes to the application. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate a new S3 bucket that has server-side encryption with customer-provided keys (SSE-C) as the encryption type. Copy the existing objects to the new S3 bucket. Specify SSE-C.
   • BCreate a new S3 bucket that has server-side encryption with Amazon S3 managed keys (SSE-S3) as the encryption type. Use S3 Batch Operations to copy the existing objects to the new S3 bucket. Specify SSE-S3.
   • CUse AWS CloudHSM to store the encryption keys. Create a new S3 bucket. Use S3 Batch Operations to copy the existing objects to the new S3 bucket. Encrypt the objects by using the keys from CloudHSM.
   • DUse the S3 Intelligent-Tiering storage class for the S3 bucket. Create an S3 Intelligent-Tiering archive configuration to transition objects that are not accessed for 90 days to S3 Glacier Deep Archive.

   Show answer

   Answer: B

   Explanation

   This option switches the encryption method from using AWS Key Management Service (AWS KMS) to using server-side encryption with S3 managed keys (SSE-S3). This change can significantly reduce costs because AWS KMS charges per API request, while SSE-S3 does not have additional charges per API request beyond the S3 usage.

   Source: Adapted from community discussion — gd1

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 176 · 527 in bank

   Select 2

   A media storage application uploads user photos to Amazon S3 for processing by AWS Lambda functions. Application state is stored in Amazon DynamoDB tables. Users are reporting that some uploaded photos are not being processed properly. The application developers trace the logs and find that Lambda is experiencing photo processing issues when thousands of users upload photos simultaneously. The issues are the result of Lambda concurrency limits and the performance of DynamoDB when data is saved. Which combination of actions should a solutions architect take to increase the performance and reliability of the application? (Choose two.)

   • AEvaluate and adjust the RCUs for the DynamoDB tables.
   • BEvaluate and adjust the WCUs for the DynamoDB tables.
   • CAdd an Amazon ElastiCache layer to increase the performance of Lambda functions.
   • DAdd an Amazon Simple Queue Service (Amazon SQS) queue and reprocessing logic between Amazon S3 and the Lambda functions.
   • EUse S3 Transfer Acceleration to provide lower latency to users.

   Show answer

   Answer: BD

   Explanation

   B - because "performance of DynamoDB when data is saved." D - you need a queue to slow things down and not loose any uploads

   Source: Adapted from community discussion — SmileyCloud

   Next question

7. Question 177 · 527 in bank

   A company runs an application in an on-premises data center. The application gives users the ability to upload media files. The files persist in a file server. The web application has many users. The application server is overutilized, which causes data uploads to fail occasionally. The company frequently adds new storage to the file server. The company wants to resolve these challenges by migrating the application to AWS. Users from across the United States and Canada access the application. Only authenticated users should have the ability to access the application to upload files. The company will consider a solution that refactors the application, and the company needs to accelerate application development. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Modify the application to use Amazon S3 to persist the files. Use Amazon Cognito to authenticate users.
   • BUse AWS Application Migration Service to migrate the application server to Amazon EC2 instances. Create an Auto Scaling group for the EC2 instances. Use an Application Load Balancer to distribute the requests. Set up AWS IAM Identity Center (AWS Single Sign-On) to give users the ability to sign in to the application. Modify the application to use Amazon S3 to persist the files.
   • CCreate a static website for uploads of media files. Store the static assets in Amazon S3. Use AWS AppSync to create an API. Use AWS Lambda resolvers to upload the media files to Amazon S3. Use Amazon Cognito to authenticate users.
   • DUse AWS Amplify to create a static website for uploads of media files. Use Amplify Hosting to serve the website through Amazon CloudFront. Use Amazon S3 to store the uploaded media files. Use Amazon Cognito to authenticate users.

   Show answer

   Answer: D

   Explanation

   The solution described in Option D leverages AWS Amplify to create a serverless and scalable architecture for media file uploads. Amplify provides an easier development experience and supports integration with Amazon S3 for file storage and Amazon Cognito for user authentication. Hosting the website through Amazon CloudFront ensures low-latency access for users across the United States and Canada. This solution minimizes operational overhead and accelerates application development. This blogpost contains a description of a similar use case: https://aws.amazon.com/ru/blogs/compute/lifting-and-shifting-a-web-application-to-aws-serverless-part-2/

   Source: Adapted from community discussion — totten

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 178 · 527 in bank

   A company has an application that is deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are part of an Auto Scaling group. The application has unpredictable workloads and frequently scales out and in. The company’s development team wants to analyze application logs to find ways to improve the application's performance. However, the logs are no longer available after instances scale in. Which solution will give the development team the ability to view the application logs after a scale-in event?

   • AEnable access logs for the ALB. Store the logs in an Amazon S3 bucket.
   • BConfigure the EC2 instances to publish logs to Amazon CloudWatch Logs by using the unified CloudWatch agent.
   • CModify the Auto Scaling group to use a step scaling policy.
   • DInstrument the application with AWS X-Ray tracing.

   Show answer

   Answer: B

   Explanation

   B is correct Option A - ALB access logs only has details about requests sent to the load balancer, not application Option C - change autosclaing behavior would NOT address the problem Option D AWS X-Ray is more suitable for tracing requests as they travel through your application, It doesn't store output logs from your application.

   Source: Adapted from community discussion — bhanus

   References

   • AWS documentation

   Next question

9. Question 179 · 527 in bank

   A security engineer determined that an existing application retrieves credentials to an Amazon RDS for MySQL database from an encrypted file in Amazon S3. For the next version of the application, the security engineer wants to implement the following application design changes to improve security: The database must use strong, randomly generated passwords stored in a secure AWS managed service. The application resources must be deployed through AWS CloudFormation. The application must rotate credentials for the database every 90 days. A solutions architect will generate a CloudFormation template to deploy the application. Which resources specified in the CloudFormation template will meet the security engineer’s requirements with the LEAST amount of operational overhead?

   • AGenerate the database password as a secret resource using AWS Secrets Manager. Create an AWS Lambda function resource to rotate the database password. Specify a Secrets Manager RotationSchedule resource to rotate the database password every 90 days.
   • BGenerate the database password as a SecureString parameter type using AWS Systems Manager Parameter Store. Create an AWS Lambda function resource to rotate the database password. Specify a Parameter Store RotationSchedule resource to rotate the database password every 90 days.
   • CGenerate the database password as a secret resource using AWS Secrets Manager. Create an AWS Lambda function resource to rotate the database password. Create an Amazon EventBridge scheduled rule resource to trigger the Lambda function password rotation every 90 days.
   • DGenerate the database password as a SecureString parameter type using AWS Systems Manager Parameter Store. Specify an AWS AppSync DataSource resource to automatically rotate the database password every 90 days.

   Show answer

   Answer: A

   Explanation

   A https://docs.aws.amazon.com/secretsmanager/latest/userguide/cloudformation.html Option B is wrong. The ParameterStore::RotationSchedule resource does not exist in CloudFormation. Option C is wrong. It does not meet the requirement because it does not use CloudFormation. Option D is wrong. The AWS::AppSync::DataSource resource is what to create data sources for resolvers in AWS AppSync to connect to.

   Source: Adapted from community discussion — Untamables

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 180 · 527 in bank

    A company runs an unauthenticated static website (www.example.com) that includes a registration form for users. The website uses Amazon S3 for hosting and uses Amazon CloudFront as the content delivery network with AWS WAF configured. When the registration form is submitted, the website calls an Amazon API Gateway API endpoint that invokes an AWS Lambda function to process the payload and forward the payload to an external API call. During testing, a solutions architect encounters a cross-origin resource sharing (CORS) error. The solutions architect confirms that the CloudFront distribution origin has the Access-Control-Allow-Origin header set to www.example.com. What should the solutions architect do to resolve the error?

    • AChange the CORS configuration on the S3 bucket. Add rules for CORS to the AllowedOrigin element for www.example.com.
    • BEnable the CORS setting in AWS WAF. Create a web ACL rule in which the Access-Control-Allow-Origin header is set to www.example.com.
    • CEnable the CORS setting on the API Gateway API endpoint. Ensure that the API endpoint is configured to return all responses that have the Access-Control-Allow-Origin header set to www.example.com.
    • DEnable the CORS setting on the Lambda function. Ensure that the return code of the function has the Access-Control-Allow-Origin header set to www.example.com.

    Show answer

    Answer: C

    Explanation

    Cross-Origin Resource Sharing (CORS) is a security measure that allows or denies scripts on webpages from making requests to a different domain than the one the script came from. The CORS policy is configured on the server side, and servers use the Access-Control-Allow-Origin header to tell the browser which domains are allowed to make requests. In the scenario provided, the error message is likely occurring because the API Gateway API endpoint used by the static website is not configured to allow www.example.com as an origin for requests.

    Source: Adapted from community discussion — gd1

    References

    • AWS documentation
    • repost.aws documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 171. 527 questions available.