SAP-C02 practice questions 341–350

1. Question 341 · 527 in bank

   A company is preparing to deploy an Amazon Elastic Kubernetes Service (Amazon EKS) cluster for a workload. The company expects the cluster to support an unpredictable number of stateless pods. Many of the pods will be created during a short time period as the workload automatically scales the number of replicas that the workload uses. Which solution will MAXIMIZE node resilience?

   • AUse a separate launch template to deploy the EKS control plane into a second cluster that is separate from the workload node groups.
   • BUpdate the workload node groups. Use a smaller number of node groups and larger instances in the node groups.
   • CConfigure the Kubernetes Cluster Autoscaler to ensure that the compute capacity of the workload node groups stays underprovisioned.
   • DConfigure the workload to use topology spread constraints that are based on Availability Zone.

   Show answer

   Answer: D

   Explanation

   I guess D, because question requres to MAXIMIZE NODE resilience. Node not workload, so we need to spread nodes across AZs.

   Source: Adapted from community discussion — HunkyBunky

   References

   • AWS documentation

   Next question

2. Question 342 · 527 in bank

   A company needs to implement a disaster recovery (DR) plan for a web application. The application runs in a single AWS Region. The application uses microservices that run in containers. The containers are hosted on AWS Fargate in Amazon Elastic Container Service (Amazon ECS). The application has an Amazon RDS for MySQL DB instance as its data layer and uses Amazon Route 53 for DNS resolution. An Amazon CloudWatch alarm invokes an Amazon EventBridge rule if the application experiences a failure. A solutions architect must design a DR solution to provide application recovery to a separate Region. The solution must minimize the time that is necessary to recover from a failure. Which solution will meet these requirements?

   • ASetup a second ECS cluster and ECS service on Fargate in the separate Region. Create an AWS Lambda function to perform the following actions: take a snapshot of the RDS DB instance, copy the snapshot to the separate Region, create a new RDS DB instance from the snapshot, and update Route 53 to route traffic to the second ECS cluster. Update the EventBridge rule to add a target that will invoke the Lambda function.
   • BCreate an AWS Lambda function that creates a second ECS cluster and ECS service in the separate Region. Configure the Lambda function to perform the following actions: take a snapshot of the RDS DB instance, copy the snapshot to the separate Region, create a new RDS DB instance from the snapshot, and update Route 53 to route traffic to the second ECS cluster. Update the EventBridge rule to add a target that will invoke the Lambda function.
   • CSetup a second ECS cluster and ECS service on Fargate in the separate Region. Create a cross-Region read replica of the RDS DB instance in the separate Region. Create an AWS Lambda function to promote the read replica to the primary database. Configure the Lambda function to update Route 53 to route traffic to the second ECS cluster. Update the EventBridge rule to add a target that will invoke the Lambda function.
   • DSetup a second ECS cluster and ECS service on Fargate in the separate Region. Take a snapshot of the RDS DB instance. Convert the snapshot to an Amazon DynamoDB global table. Create an AWS Lambda function to update Route 53 to route traffic to the second ECS cluster. Update the EventBridge rule to add a target that will invoke the Lambda function.

   Show answer

   Answer: C

   Explanation

   Answer C. Configure RDS read-replica instead of Snapshots. Invoke Lambda function to promote read-replica to primary and update Route53 to point to secondary region incase of DR

   Source: Adapted from community discussion — shaaam80

   Next question

3. Question 343 · 527 in bank

   A company has AWS accounts that are in an organization in AWS Organizations. The company wants to track Amazon EC2 usage as a metric. The company’s architecture team must receive a daily alert if the EC2 usage is more than 10% higher the average EC2 usage from the last 30 days. Which solution will meet these requirements?

   • AConfigure AWS Budgets in the organization's management account. Specify a usage type of EC2 running hours. Specify a daily period. Set the budget amount to be 10% more than the reported average usage for the last 30 days from AWS Cost Explorer. Configure an alert to notify the architecture team if the usage threshold is met
   • BConfigure AWS Cost Anomaly Detection in the organization's management account. Configure a monitor type of AWS Service. Apply a filter of Amazon EC2. Configure an alert subscription to notify the architecture team if the usage is 10% more than the average usage for the last 30 days.
   • CEnable AWS Trusted Advisor in the organization's management account. Configure a cost optimization advisory alert to notify the architecture team if the EC2 usage is 10% more than the reported average usage for the last 30 days.
   • DConfigure Amazon Detective in the organization's management account. Configure an EC2 usage anomaly alert to notify the architecture team if Detective identifies a usage anomaly of more than 10%.

   Show answer

   Answer: A

   Explanation

   Answer A. C cannot be correct because Cost Anomaly detection is for a surprise cost exceeds. A is a perfect use case for this scenario.

   Source: Adapted from community discussion — shaaam80

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 344 · 527 in bank

   An e-commerce company is revamping its IT infrastructure and is planning to use AWS services. The company’s CIO has asked a solutions architect to design a simple, highly available, and loosely coupled order processing application. The application is responsible for receiving and processing orders before storing them in an Amazon DynamoDB table. The application has a sporadic traffic pattern and should be able to scale during marketing campaigns to process the orders with minimal delays. Which of the following is the MOST reliable approach to meet the requirements?

   • AReceive the orders in an Amazon EC2-hosted database and use EC2 instances to process them.
   • BReceive the orders in an Amazon SQS queue and invoke an AWS Lambda function to process them.
   • CReceive the orders using the AWS Step Functions program and launch an Amazon ECS container to process them.
   • DReceive the orders in Amazon Kinesis Data Streams and use Amazon EC2 instances to process them.

   Show answer

   Answer: B

   Explanation

   Using an Amazon SQS queue (option B) and an AWS Lambda function is the most reliable approach for several reasons: Scalability: AWS Lambda can automatically scale based on incoming requests, ensuring that orders are processed quickly even during peak traffic. High availability: By using a message queue like SQS, orders are stored temporarily until they can be processed, ensuring that no orders are lost due to system failures. Loosely coupled architecture: The use of an SQS queue and Lambda function decouples the order processing from the storage (Amazon DynamoDB) in a separate logical layer, making it easier to scale and maintain individual components independently. Handling sporadic traffic patterns: AWS Lambda provides a serverless computing experience that automatically scales based on demand, making it well-suited for handling variable workload spikes.

   Source: Adapted from community discussion — AzureDP900

   Next question

5. Question 345 · 527 in bank

   A company is deploying AWS Lambda functions that access an Amazon RDS for PostgreSQL database. The company needs to launch the Lambda functions in a QA environment and in a production environment. The company must not expose credentials within application code and must rotate passwords automatically. Which solution will meet these requirements?

   • AStore the database credentials for both environments in AWS Systems Manager Parameter Store. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key. Within the application code of the Lambda functions, pull the credentials from the Parameter Store parameter by using the AWS SDK for Python (Boto3). Add a role to the Lambda functions to provide access to the Parameter Store parameter.
   • BStore the database credentials for both environments in AWS Secrets Manager with distinct key entry for the QA environment and the production environment. Turn on rotation. Provide a reference to the Secrets Manager key as an environment variable for the Lambda functions.
   • CStore the database credentials for both environments in AWS Key Management Service (AWS KMS). Turn on rotation. Provide a reference to the credentials that are stored in AWS KMS as an environment variable for the Lambda functions.
   • DCreate separate S3 buckets for the QA environment and the production environment. Turn on server-side encryption with AWS KMS keys (SSE-KMS) for the S3 buckets. Use an object naming pattern that gives each Lambda function’s application code the ability to pull the correct credentials for the function's corresponding environment. Grant each Lambda function's execution role access to Amazon S3.

   Show answer

   Answer: B

   Next question

6. Question 346 · 527 in bank

   A company recently deployed an application on AWS. The application uses Amazon DynamoDB. The company measured the application load and configured the RCUs and WCUs on the DynamoDB table to match the expected peak load. The peak load occurs once a week for a 4-hour period and is double the average load. The application load is close to the average load for the rest of the week. The access pattern includes many more writes to the table than reads of the table. A solutions architect needs to implement a solution to minimize the cost of the table. Which solution will meet these requirements?

   • AUse AWS Application Auto Scaling to increase capacity during the peak period. Purchase reserved RCUs and WCUs to match the average load.
   • BConfigure on-demand capacity mode for the table.
   • CConfigure DynamoDB Accelerator (DAX) in front of the table. Reduce the provisioned read capacity to match the new peak load on the table.
   • DConfigure DynamoDB Accelerator (DAX) in front of the table. Configure on-demand capacity mode for the table.

   Show answer

   Answer: A

   Explanation

   A on-demand prices can be 7 times higher, given the options it is better to have reserved WCU and RCU and auto scale in the given schedule

   Source: Adapted from community discussion — ccort

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 347 · 527 in bank

   A company is using AWS Control Tower to manage AWS accounts in an organization in AWS Organizations. The company has an OU that contains accounts. The company must prevent any new or existing Amazon EC2 instances in the OU's accounts from gaining a public IP address. Which solution will meet these requirements?

   • AConfigure all instances in each account in the OU to use AWS Systems Manager. Use a Systems Manager Automation runbook to prevent public IP addresses from being attached to the instances.
   • BImplement the AWS Control Tower proactive control to check whether instances in the OU's accounts have a public IP address. Set the AssociatePublicIpAddress property to False. Attach the proactive control to the OU.
   • CCreate an SCP that prevents the launch of instances that have a public IP address. Additionally, configure the SCP to prevent the attachment of a public IP address to existing instances. Attach the SCP to the OU.
   • DCreate an AWS Config custom rule that detects instances that have a public IP address. Configure a remediation action that uses an AWS Lambda function to detach the public IP addresses from the instances.

   Show answer

   Answer: C

   Explanation

   Option C - From AWS doc page "Don't use AWS Organizations to update service control policies (SCPs) attached to an OU that is registered with AWS Control Tower. Doing so could result in the controls entering an unknown state, which will require you to repair your landing zone or re-register your OU in AWS Control Tower. Instead, you can create new SCPs and attach those to the OUs rather than editing the SCPs that AWS Control Tower has created." https://docs.aws.amazon.com/controltower/latest/userguide/orgs-guidance.html

   Source: Adapted from community discussion — TonytheTiger

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 348 · 527 in bank

   A company is deploying a third-party web application on AWS. The application is packaged as a Docker image. The company has deployed the Docker image as an AWS Fargate service in Amazon Elastic Container Service (Amazon ECS). An Application Load Balancer (ALB) directs traffic to the application. The company needs to give only a specific list of users the ability to access the application from the internet. The company cannot change the application and cannot integrate the application with an identity provider. All users must be authenticated through multi-factor authentication (MFA). Which solution will meet these requirements?

   • ACreate a user pool in Amazon Cognito. Configure the pool for the application. Populate the pool with the required users. Configure the pool to require MFConfigure a listener rule on the ALB to require authentication through the Amazon Cognito hosted UI.
   • BConfigure the users in AWS Identity and Access Management (IAM). Attach a resource policy to the Fargate service to require users to use MFA. Configure a listener rule on the ALB to require authentication through IAM.
   • CConfigure the users in AWS Identity and Access Management (IAM). Enable AWS IAM Identity Center (AWS Single Sign-On). Configure resource protection for the ALB. Create a resource protection rule to require users to use MFA.
   • DCreate a user pool in AWS Amplify. Configure the pool for the application. Populate the pool with the required users. Configure the pool to require MFA. Configure a listener rule on the ALB to require authentication through the Amplify hosted UI.

   Show answer

   Answer: A

   Explanation

   A? As GPT says, In this scenario, setting up a user pool in Amazon Cognito allows you to define the specific list of users who can access the application. You can configure the user pool to require multi-factor authentication (MFA), ensuring an additional layer of security for user authentication. Configuring the ALB listener rule to require authentication through the Amazon Cognito hosted UI means that users attempting to access the application through the ALB will be redirected to the Cognito hosted UI for authentication, where they'll need to provide their credentials and MFA code. This setup ensures that only authenticated users from the specific user pool with MFA will have access to the application, meeting the requirements without modifying the application itself.

   Source: Adapted from community discussion — JMAN1

   References

   • repost.aws documentation

   Next question

9. Question 349 · 527 in bank

   A solutions architect is preparing to deploy a new security tool into several previously unused AWS Regions. The solutions architect will deploy the tool by using an AWS CloudFormation stack set. The stack set's template contains an IAM role that has a custom name. Upon creation of the stack set, no stack instances are created successfully. What should the solutions architect do to deploy the stacks successfully?

   • AEnable the new Regions in all relevant accounts. Specify the CAPABILITY_NAMED_IAM capability during the creation of the stack set.
   • BUse the Service Quotas console to request a quota increase for the number of CloudFormation stacks in each new Region in all relevant accounts. Specify the CAPABILITY_IAM capability during the creation of the stack set.
   • CSpecify the CAPABILITY_NAMED_IAM capability and the SELF_MANAGED permissions model during the creation of the stack set.
   • DSpecify an administration role ARN and the CAPABILITY_IAM capability during the creation of the stack set.

   Show answer

   Answer: A

   Explanation

   Some stack templates might include resources that can affect permissions in your AWS account; for example, by creating new AWS Identity and Access Management (IAM) users. For those stacks, you must explicitly acknowledge this by specifying one of these capabilities. https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html

   Source: Adapted from community discussion — kejam

   References

   • AWS documentation

   Next question

10. Question 350 · 527 in bank

    A company has an application that uses an Amazon Aurora PostgreSQL DB cluster for the application's database. The DB cluster contains one small primary instance and three larger replica instances. The application runs on an AWS Lambda function. The application makes many short-lived connections to the database's replica instances to perform read-only operations. During periods of high traffic, the application becomes unreliable and the database reports that too many connections are being established. The frequency of high-traffic periods is unpredictable. Which solution will improve the reliability of the application?

    • AUse Amazon RDS Proxy to create a proxy for the DB cluster. Configure a read-only endpoint for the proxy. Update the Lambda function to connect to the proxy endpoint.
    • BIncrease the max_connections setting on the DB cluster's parameter group. Reboot all the instances in the DB cluster. Update the Lambda function to connect to the DB cluster endpoint.
    • CConfigure instance scaling for the DB cluster to occur when the DatabaseConnections metric is close to the max connections setting. Update the Lambda function to connect to the Aurora reader endpoint.
    • DUse Amazon RDS Proxy to create a proxy for the DB cluster. Configure a read-only endpoint for the Aurora Data API on the proxy. Update the Lambda function to connect to the proxy endpoint.

    Show answer

    Answer: A

    Explanation

    The other options have limitations or do not address the root cause of the issue: Option B (Increasing max_connections): While increasing the maximum number of connections allowed on the DB cluster may provide a temporary solution, it does not address the underlying issue of inefficient connection management, and it may lead to increased resource consumption and potential performance degradation. Option C (Instance scaling): While instance scaling can help increase the overall capacity of the DB cluster, it does not directly address the issue of too many connections being established. Additionally, it may not be effective if the high-traffic periods are unpredictable and short-lived. Option D (RDS Proxy with Aurora Data API): The Aurora Data API is designed for serverless applications to interact with Aurora Serverless databases using a web services model, not for traditional database connections. It does not address the issue of connection management for the existing application architecture.

    Source: Adapted from community discussion — 0b43291

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 341. 527 questions available.