Question 500
An ECS worker processes SQS standard-queue videos; each task takes anywhere from 40 seconds to 25 minutes. The configured short visibility timeout lets a second worker pick up long-running tasks, but setting it permanently to 30 minutes makes genuine worker crashes slow to retry. The worker can report healthy progress and retain each message receipt handle. What is the most targeted control?
- Increase the queue-level visibility timeout permanently to its longest supported interval, even for tasks that usually finish in forty seconds.
- Implement a worker heartbeat that calls ChangeMessageVisibility to extend only the in-progress message invisibility as needed, and delete after success.
- Add SQS long polling and assume waiting longer for ReceiveMessage extends the visibility of a message that has already been received by an active worker.
- Increase the DLQ maxReceiveCount for every task and assume this postpones premature concurrent delivery of an in-progress long job.
Explanation
Correct Answer
B:ChangeMessageVisibility can extend an individual message’s visibility while processing continues, balancing long successful jobs with timely failed-worker retries.
Incorrect Answers
A:A permanently long timeout delays delivery after a real worker crash; using individual ChangeMessageVisibility progress updates better balances the short and long jobs.
C:Long polling affects message acquisition and empty receives, not the invisibility timeout for a message already delivered.
D:DLQ redrive thresholds govern repeated failures, not when a currently running message becomes visible again.
Question 501
An ALB target group uses a meaningful HTTP readiness endpoint, but a deployment causes healthy targets to be marked unhealthy after a single transient timeout. Instances recover in seconds, yet aggressive health-check thresholds cause repeated target removal and re-registration under load. What should the architect tune?
- Change the health-check path to a static 200 page that never checks critical application readiness, and assume the false unhealthy events are resolved safely.
- Adjust target group health-check interval, timeout, and healthy/unhealthy thresholds using latency measurements, while preserving the application-aware readiness endpoint.
- Increase only Auto Scaling desired capacity and leave the target group unhealthy-threshold and timeout values at their overly sensitive settings.
- Delete all target group health checks and send traffic to failing targets regardless of readiness.
Explanation
Correct Answer
B:Health-check thresholds and timing control the number of failed/successful probes required for state changes; tuning them against measured transient behavior reduces flapping without masking true outages.
Incorrect Answers
A:A shallow always-green page can hide real failures and does not address overly sensitive thresholding.
C:Each replacement target can flap under the same health-check criteria; adding capacity alone does not repair erroneous target state changes.
D:Without target health checks the ALB cannot reliably remove unhealthy instances from routing.
Question 502
A platform sees repeated retries against RDS after a short outage. Hundreds of application tasks reconnect simultaneously and exhaust the database as soon as it recovers. What resilience behavior should be changed?
- Make every task reconnect immediately in a tight loop without delay until the connection succeeds.
- Disable all connection timeouts so requests remain blocked indefinitely through any downstream failure.
- Increase RDS max_connections and allow all clients to retry immediately in synchrony after a brief database restart.
- Introduce bounded retries with exponential backoff and jitter plus sensible connection pool limits.
Explanation
Correct Answer
D:Jitter and retry budgets desynchronize reconnections, helping a recovering database avoid another coordinated load surge.
Incorrect Answers
A:Tight retries amplify the retry storm already identified as the cause of repeated overload.
B:Unbounded waits consume application resources and do not control reconnection concurrency.
C:A higher connection limit may postpone saturation but does not desynchronize coordinated connection retries and may overload the database again.
Question 503
An Auto Scaling group has a maximum desired capacity larger than the account quota for its target EC2 family. During a peak, CreateInstances requests are rejected by Service Quotas and the API tier fails to add capacity. What should operations do?
- Raise the Auto Scaling desired count and maximum group size without requesting a separate EC2 quota increase or adding eligible launch capacity.
- Increase capacity reservations in a different Region while keeping the quota-limited application Auto Scaling group tied to its existing Region.
- Forecast capacity needs, request required quota increases ahead of time, and diversify supported instance families and AZs.
- Increase only the Auto Scaling maximum again without changing the separate EC2 quota that rejects API launches.
Explanation
Correct Answer
C:Autoscaling cannot launch beyond effective EC2 quotas and available capacity, so reliable scale-out needs planned quota and pool headroom.
Incorrect Answers
A:The group’s desired size is not the EC2 service quota; larger requested counts remain rejected when the family quota is binding.
B:Unrelated reservations do not authorize launches in the constrained local instance family or Region.
D:A larger ASG setting cannot grant AWS permissions or quota allocations that prevent the instance launch.
Question 504
An Aurora PostgreSQL cluster has several healthy readers sized for different purposes. Production API reads should continue using the regular reader endpoint, but batch reporting must target only two designated analytics replicas and never land on the low-latency API reader pool. Which Aurora endpoint design makes that routing explicit?
- Connect all reporting clients to the primary writer endpoint, increasing competition with transactional writes despite the available reporting replicas.
- Set every Aurora Replica to the same failover promotion tier; that changes which readers receive SELECT queries on the reader endpoint.
- Create a custom Aurora endpoint selecting the two analytics replicas and point reporting clients to it, while leaving API reads on their appropriate endpoint.
- Increase reader-endpoint DNS TTL and assume reporting connections will be routed only to two preselected analytics replicas without custom endpoint membership.
Explanation
Correct Answer
C:Aurora custom endpoints balance connections among chosen DB instances, allowing distinct reader pools without altering failover promotion priorities.
Incorrect Answers
A:Sending independent reporting reads to the writer adds avoidable load and does not isolate analytics from latency-sensitive reads.
B:Promotion tiers affect writer failover choice, not the membership-based routing of normal SELECT connections to a custom subset.
D:DNS caching does not change which replicas participate in the shared reader endpoint; custom endpoints provide subset routing.
Question 505
A payment service already runs a DynamoDB multi-Region eventual-consistency (MREC) global table with writable replicas in two Regions. Operations observes unusually stale secondary-Region reads after a large source update, but basic regional availability checks remain healthy. The team needs a first-party replication-specific telemetry signal to determine whether one Region pair is falling behind before changing application routing. Which monitoring approach should be added?
- Review only the total number of table reads in the source Region; aggregate requests directly report the replication propagation time for every other Region.
- Track DynamoDB CloudWatch ReplicationLatency for the relevant source/destination Region pairs, investigate sustained increases, and distinguish propagation lag from regional endpoint availability.
- Enable DynamoDB Streams consumers only in the source Region and assume successful stream reads prove another Region replica has already received those items.
- Switch the existing MREC table to a GSI on the write timestamp and assume the index produces cross-Region lag metrics.
Explanation
Correct Answer
B:MREC global tables publish ReplicationLatency for source/destination Region pairs; elevated duration can reveal replication delay even while local APIs continue serving requests, allowing targeted investigation and routing tests.
Incorrect Answers
A:Table read counts measure workload volume rather than the elapsed time of item propagation to another Region.
C:A source Stream record can appear before the change is delivered to a remote replica, so source-stream activity does not prove cross-Region visibility.
D:A same-table secondary index provides an alternative query path but not the regional propagation-delay measurement required.
Question 506
A Java order-fulfillment platform already enqueues ordinary requests durably to an SQS standard queue. New orders can contain signed regulatory documents as part of the event payload; some serialized messages exceed the normal SQS inline message limit, but consumers must continue using the existing queue and retrieve the document reliably. The company has an approved private S3 bucket and can grant scoped S3 access to the producer and workers. Which supported large-payload approach should it adopt?
- Raise the queue visibility timeout to several hours and send each oversized binary document directly as the SQS message body, assuming visibility controls the payload size limit.
- Split the serialized document into arbitrary unordered queue messages but omit correlation identifiers or reassembly validation.
- Use the supported SQS Extended Client Library with Amazon S3 to store large payloads in the approved bucket and enqueue object references, then retrieve and clean up payloads through the consumer workflow.
- Replace the durable SQS queue with ALB access logs, assuming a successful HTTP connection stores the full document for later replay.
Explanation
Correct Answer
C:The Extended Client Library uses S3 to hold oversized message content and carries an SQS message reference, allowing consumers with approved S3 permissions to fetch the payload while retaining queue delivery semantics; storage cleanup and IAM access must be controlled.
Incorrect Answers
A:Visibility timeout controls redelivery timing after receipt, not the maximum inline SQS message payload size.
B:Without an ordered/reassemblable contract and integrity checks, independent fragments can be lost or misinterpreted as complete order documents.
D:Load balancer access logs record request metadata and cannot replace durable queue messages or S3 storage of an oversized signed document.
Question 507
A production service stores signed-in user sessions exclusively on one EC2 instance disk. When Auto Scaling replaces the instance, users lose their shopping carts although the database remains intact. What architectural principle should be applied?
- Externalize durable session state to an appropriate shared store or redesign the application for stateless, resumable sessions.
- Configure ALB stickiness to one particular EC2 host and treat the resulting local disk sessions as durable across instance termination.
- Disable Auto Scaling replacement of failed instances so customers keep relying on broken host-local storage.
- Add an EBS snapshot of the application instance each week and assume current in-memory sessions are recovered instantly whenever Auto Scaling replaces a node.
Explanation
Correct Answer
A:Replaceable compute nodes cannot be the sole authoritative store for business state that must survive scaling and failures.
Incorrect Answers
B:Sticky sessions can direct requests to the same live host but do not persist state when that host is replaced.
C:Preventing recovery reduces availability and does not make ephemeral session data durable.
D:Periodic backups do not provide up-to-date, shared, low-latency session state across active replacement instances.
Question 508
An organization runs an API across two Regions with a healthy passive standby. During a recovery drill, traffic remains on the failing Region because Route 53 health checks test only a generic status page that remains green while checkout fails. What should be improved?
- Lower Route 53 DNS TTL alone, without changing the always-green health check that fails to detect broken checkout transactions.
- Design health signals for critical user transaction readiness and test controlled failover with regional application dependencies.
- Delete the standby application entirely so health checks only ever see the primary Region.
- Increase regional endpoint health-check interval but retain the same root path that responds 200 while checkout fails.
Explanation
Correct Answer
B:A shallow health path can hide real application failure; routing should rely on meaningful endpoint health and tested recovery controls.
Incorrect Answers
A:A shorter TTL only helps distribute updated answers after a failure is detected; it cannot fix a shallow health check that remains healthy.
C:Removing the alternate endpoint defeats the multi-Region recovery purpose.
D:Changing probe frequency without testing business dependencies still misses the failing transaction path.
Question 509
An EC2 Auto Scaling group spans two Availability Zones and an Application Load Balancer performs target health checks. Some instances become unhealthy but remain in service because the ASG health check type is EC2 only. Which change repairs instance replacement behavior?
- Increase only the desired capacity while continuing to ignore known unhealthy ALB targets in the Auto Scaling health model.
- Disable load-balancer health checking and assume TCP connectivity establishes application correctness.
- Use an AWS Config rule to identify unhealthy ALB targets every evening but do not allow the ASG to use ELB health check results for replacement.
- Configure the group to use Elastic Load Balancing health checks with an appropriate grace period and verify replacements.
Explanation
Correct Answer
D:ELB health signals allow Auto Scaling to replace instances failing application health, not merely underlying EC2 status checks.
Incorrect Answers
A:Extra capacity cannot consistently replace application-broken instances if the ASG never treats them as unhealthy.
B:Disabling health probes makes failing applications more likely to receive production traffic.
C:Periodic compliance reporting cannot provide the group’s operational application-health replacement signal.
Question 510
An ECS service uses rolling deployments with desired count 3. Its deployment configuration sets minimumHealthyPercent to 100 and maximumPercent to 100. Every deployment stalls because ECS cannot start a replacement before stopping a task and cannot stop a task without dropping below the minimum. Which adjustment fixes the deployment arithmetic without making the service unavailable?
- Permit surge capacity by raising maximumPercent to a value that allows at least one extra replacement task while maintaining the required minimum healthy count.
- Enable only deployment circuit breaker rollback without changing the mathematically impossible task-placement constraints.
- Lower minimumHealthyPercent below 100 but retain maximumPercent=100, knowingly causing in-service task shutdown before replacement capacity becomes healthy.
- Set the desired count to zero during every release to guarantee that tasks cannot be unhealthy.
Explanation
Correct Answer
A:ECS rolling deploys need a configuration that permits at least one task to be started or stopped; maximumPercent above 100 provides surge headroom while minimumHealthyPercent can preserve existing healthy capacity.
Incorrect Answers
B:Circuit breakers detect failed deployments but cannot create task surge capacity when current deployment percentages forbid both stop and start.
C:A lower minimum can permit stopping existing tasks but conflicts with the stated no-availability-drop requirement when there is no surge headroom.
D:Scaling to zero abandons service availability and violates the stated no-outage deployment requirement.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests