Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 21

Question 200

A company’s production CloudFormation stack must never be deleted by an accidental console click, but its authorized application resources must still be updatable through change sets. Which stack-level protection fits?

Apply a stack policy that denies updates to every logical resource and assume that policy blocks DeleteStack operations.
Enable CloudFormation termination protection for the production stack and maintain controlled update permissions.
Configure a stack policy that denies every resource update and assume it alone prevents DeleteStack.
Give the application operator only read access to the CloudFormation stack while relying on that access model to block accidental DeleteStack by other authorized administrators.

Explanation

Correct Answer

Termination protection blocks ordinary DeleteStack attempts while preserving separately authorized update workflows.

Incorrect Answers

Stack policies limit resource updates; preventing entire stack deletion requires termination protection.

Stack policies protect selected update actions but are not the dedicated stack deletion control.

Reducing one operator’s permissions can help, but it is not the stack-level termination protection requested against accidental authorized deletion.

Question 201

A financial institution deploys production infrastructure through CodePipeline. Its release policy requires an authorized change manager to inspect security scan evidence before the production stage can run. Which pipeline feature directly enforces this human decision point?

Add a manual approval action between validated staging and production deployment with scoped approvers and audit notifications.
Use a CodePipeline automated CloudWatch alarm gate in place of an authorized person inspecting security scan evidence.
Make the production deploy action the first pipeline stage so failures are visible sooner.
Require a CodeBuild test report named approved without a CodePipeline manual approval action or authorized approver.

Explanation

Correct Answer

CodePipeline approval actions can prevent downstream execution until an authorized approver explicitly approves the change.

Incorrect Answers

An automated metric alarm can block certain failures, but does not establish the required explicit human approval by a change manager.

Deploying before review violates the stated controlled release governance.

A report label does not implement the requested controlled human decision point or independent approval audit.

Question 202

A microservice team deploys ECS services behind an ALB. It needs canary traffic shifting to a replacement task set and automatic rollback when a CloudWatch error alarm triggers. Which ECS deployment pattern should be configured?

Update the ECS service image immediately on every task without separate target groups or monitored traffic shifting.
Use ECS rolling deployments with a circuit breaker but no second target group and assume this offers weighted blue/green canary traffic.
Switch all Application Load Balancer traffic at once to one replacement ECS target group without CloudWatch alarm rollback.
Use CodeDeploy blue/green ECS deployment with two target groups, traffic shifting and configured CloudWatch alarms.

Explanation

Correct Answer

CodeDeploy can orchestrate ECS replacement task sets and controlled traffic migration with monitored rollback.

Incorrect Answers

An all-at-once update loses the canary isolation and automatic rollback behavior required.

Rolling circuit-breaker rollback can handle failed deployments but does not implement CodeDeploy blue/green weighted target-group traffic shifting.

An all-at-once routing change lacks the required gradual canary observation and automated alarm rollback.

Question 203

A Lambda team needs to preserve a stable function version for traffic currently serving users and slowly migrate invocations to a candidate version without modifying client function names. Which Lambda routing primitive should be used?

Publish two immutable Lambda versions and update the function’s unqualified ARN used by clients instead of a stable alias.
Publish immutable function versions and configure a weighted alias that shifts a controlled fraction of invocations to the new version.
Modify $LATEST and call it an immutable published version for all clients.
Configure Lambda provisioned concurrency only, assuming concurrency reservations direct a chosen percentage of invocations to each published version.

Explanation

Correct Answer

A Lambda alias can distribute invocations across published versions while clients invoke a stable alias ARN.

Incorrect Answers

Using separate version ARNs requires caller changes or a separate routing layer; a weighted alias keeps the invocation name stable.

$LATEST is mutable and does not supply the controlled published-version rollout semantics.

Provisioned concurrency preinitializes execution environments; it does not route caller traffic percentages between function versions.

Question 204

A team deploys critical configuration changes to mobile application backends. A bad feature flag must be rolled back automatically when an associated error-rate alarm breaches a threshold during gradual rollout. Which managed configuration deployment service is relevant?

Use AWS AppConfig with validators, a controlled deployment strategy and automatic CloudWatch alarm-based rollback.
Store the flag directly in an EC2 AMI and require replacement of all machines before a rollback can start.
Store feature flag configuration in Systems Manager Parameter Store and rely only on periodic application reads without a staged deployment or alarm rollback mechanism.
Use CloudFormation change sets to modify every application environment variable simultaneously without a staged runtime feature deployment.

Explanation

Correct Answer

AppConfig can deploy application configuration gradually and halt or roll back when monitors detect regression.

Incorrect Answers

Embedding dynamic configuration in immutable host images adds unnecessary delay and lacks staged config rollback control.

Parameter Store can hold values but does not itself implement AppConfig validators, gradual deployment strategy or automated CloudWatch alarm rollback.

Infrastructure change sets preview resources but do not supply a validated progressive flag rollout with automatic rollback.

Question 205

An EKS deployment manages a customer-facing service with four pods. A voluntary node maintenance operation repeatedly removes too many pods at once and violates availability targets despite healthy readiness probes. Which Kubernetes safety construct should be assessed?

Increase Deployment maxSurge and maxUnavailable limits only and assume the settings protect pods against voluntary node drain evictions.
Set an appropriate PodDisruptionBudget and verify available replica capacity before voluntary evictions.
Remove readiness probes because they cause nodes to drain faster during maintenance.
Add a cluster autoscaler policy but permit node drains to evict all available replicas at once with no PDB.

Explanation

Correct Answer

A PodDisruptionBudget constrains voluntary disruption when Kubernetes drains nodes, helping protect service availability.

Incorrect Answers

Deployment rolling-update limits apply to controller rollouts; PodDisruptionBudgets specifically constrain voluntary disruptions such as node drain.

Readiness controls traffic to pods and is not the budget that limits voluntary simultaneous evictions.

More nodes improve capacity but do not ensure an allowed minimum number of application pods during voluntary eviction.

Question 206

A software team deploys container images to production EKS and wants each release to refer to exactly the image artifact tested by its build pipeline. Developers currently deploy a mutable latest tag that can point to different bytes later. Which change prevents silent artifact drift?

Enable registry tag immutability but deploy image references without verifying the tested digest in approved production manifests.
Pin deployment manifests to the approved immutable image digest and use a controlled image-signing or provenance validation process.
Continue deploying latest and assume every registry tag is cryptographically immutable by default.
Use ECR enhanced vulnerability scanning as a replacement for verifying that the container bytes exactly match the tested release digest.

Explanation

Correct Answer

An image digest identifies exact image content, so deployment does not silently change when a registry tag is moved.

Incorrect Answers

Tag immutability helps within a repository but the deployment should pin the exact independently tested image digest for reproducible artifact identity.

Mutable tags can be repointed to different image bytes and do not prove which artifact passed testing.

Vulnerability findings do not by themselves establish deployment identity or protect against accidental mutable-tag substitution.

Question 207

An Elastic Beanstalk web application deploys updates to instances in an Auto Scaling environment. The team requires that the current fleet remain available until a separately created new fleet passes health checks, accepting temporary duplicate capacity charges. Which deployment option fits?

Use an Elastic Beanstalk rolling deployment with an extra batch, which still updates part of the existing capacity in place.
Use an immutable Elastic Beanstalk deployment that creates a separate group of instances and switches only after health checks succeed.
Use an all-at-once in-place deployment that updates every live instance simultaneously.
Use an Elastic Beanstalk all-at-once application version update and rely on ELB health checks after all live instances have changed.

Explanation

Correct Answer

Immutable deployments retain the existing instances while new capacity is tested, limiting impact of failed releases.

Incorrect Answers

Rolling with an additional batch can preserve capacity but does not create a separate full immutable replacement fleet that remains isolated until verified.

Updating all existing instances at once eliminates the tested replacement fleet and increases disruption risk.

All-at-once updates the current fleet and cannot preserve the old fleet during validation, violating the immutable deployment requirement.

Question 208

An EKS deployment must update a service with near-zero disruption. The current rolling strategy removes two of three pods before any replacement passes readiness. Which Kubernetes rolling update settings should be tuned?

Increase maxUnavailable to all replicas so the deployment can remove every pod before any replacement starts.
Disable readiness and liveness evaluation so the controller counts newly started but unready pods as fully healthy.
Set maxSurge to zero and maxUnavailable to the number of all replicas while relying on readiness probes after replacements are scheduled.
Reduce maxUnavailable and permit suitable maxSurge, combined with accurate readiness probes and adequate spare capacity.

Explanation

Correct Answer

RollingUpdate surge and unavailable limits control replacement pacing, while readiness prevents unhealthy pods from serving.

Incorrect Answers

Allowing all replicas unavailable is contrary to the near-zero interruption requirement.

Ignoring readiness can route user traffic to not-yet-initialized application pods.

Removing all replicas before surge is available causes downtime; permit extra pods and keep maxUnavailable low during replacements.

Question 209

An infrastructure team uses nested CloudFormation stacks. It wants to review how a planned parent stack update would affect nested resources, not merely inspect the parent’s top-level change summary. What should be generated before executing?

Create a parent-only CloudFormation change set without nested change-set inclusion, then assume it includes full replacement detail for every nested resource.
Create a change set that includes nested stack change sets where supported, then inspect the nested resource replacements and dependencies.
Run only CloudFormation drift detection on the live parent and assume it previews every possible future template replacement.
Run CloudFormation drift detection to compare deployed resources against the current template, without planning the proposed parent-template update.

Explanation

Correct Answer

Nested change-set visibility reveals proposed changes in child stacks that otherwise may be hidden behind parent-level entries.

Incorrect Answers

A parent-only summary does not provide the requested nested-stack change-set detail; include nested changes where supported.

Drift compares current deployed state with declared state and is not a proposal impact preview.

Drift detection reports differences from current definitions; it does not preview all future nested-stack changes in the proposed update.

Question 210

A team uses CloudFormation to create a production storage bucket that already exists and contains important data. It now wants that bucket governed in a stack without deleting or recreating it. Which migration action should be considered?

Add a resource with the existing bucket physical name to a stack template and execute CreateStack without the supported resource-import operation.
Use supported CloudFormation resource import with the correct template, identifiers and drift review.
Use CloudFormation drift detection on a stack that does not yet own the bucket and assume the operation adopts it automatically.
Set only a stack termination-protection flag and assume it automatically imports the external bucket.

Explanation

Correct Answer

Resource import brings eligible existing resources under stack management without replacing the live data-bearing resource.

Incorrect Answers

Ordinary stack creation attempts to create a new resource; importing an existing physical bucket requires the resource import workflow.

Drift detection cannot register an unmanaged resource; a supported import step must establish stack ownership first.

Termination protection has no function for adopting a preexisting resource into a stack.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 200

Explanation

Correct Answer

Incorrect Answers

Question 201

Explanation

Correct Answer

Incorrect Answers

Question 202

Explanation

Correct Answer

Incorrect Answers

Question 203

Explanation

Correct Answer

Incorrect Answers

Question 204

Explanation

Correct Answer

Incorrect Answers

Question 205

Explanation

Correct Answer

Incorrect Answers

Question 206

Explanation

Correct Answer

Incorrect Answers

Question 207

Explanation

Correct Answer

Incorrect Answers

Question 208

Explanation

Correct Answer

Incorrect Answers

Question 209

Explanation

Correct Answer

Incorrect Answers

Question 210

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests