Question 510
An ECS service uses rolling deployments with desired count 3. Its deployment configuration sets minimumHealthyPercent to 100 and maximumPercent to 100. Every deployment stalls because ECS cannot start a replacement before stopping a task and cannot stop a task without dropping below the minimum. Which adjustment fixes the deployment arithmetic without making the service unavailable?
- Permit surge capacity by raising maximumPercent to a value that allows at least one extra replacement task while maintaining the required minimum healthy count.
- Enable only deployment circuit breaker rollback without changing the mathematically impossible task-placement constraints.
- Lower minimumHealthyPercent below 100 but retain maximumPercent=100, knowingly causing in-service task shutdown before replacement capacity becomes healthy.
- Set the desired count to zero during every release to guarantee that tasks cannot be unhealthy.
Explanation
Correct Answer
A:ECS rolling deploys need a configuration that permits at least one task to be started or stopped; maximumPercent above 100 provides surge headroom while minimumHealthyPercent can preserve existing healthy capacity.
Incorrect Answers
B:Circuit breakers detect failed deployments but cannot create task surge capacity when current deployment percentages forbid both stop and start.
C:A lower minimum can permit stopping existing tasks but conflicts with the stated no-availability-drop requirement when there is no surge headroom.
D:Scaling to zero abandons service availability and violates the stated no-outage deployment requirement.
Question 511
A Lambda consumer reads batches from an SQS FIFO queue, using a message group for each account. Partial batch responses with ReportBatchItemFailures are already enabled. The handler processes records in order but one record fails and later records from the same group would otherwise be acknowledged as successful, violating ordering. How must the handler report failures?
- Acknowledge all later messages from the group as successful even when the earlier business operation failed.
- Return only the first failed message ID and mark all later, unprocessed messages in the FIFO batch successful.
- Stop processing after the first failure and include that failed record plus every unprocessed record in batchItemFailures, preserving the intended FIFO ordering.
- Throw an exception and return no individual failed IDs; assume FIFO will retry only the failed record.
Explanation
Correct Answer
C:AWS recommends stopping after the first FIFO failure and returning failed and unprocessed message identifiers to retain ordering with partial batch responses.
Incorrect Answers
A:Acknowledging subsequent records after an earlier failed FIFO item may break per-group business ordering requirements.
B:For FIFO ordering, unprocessed records following the first failure also need inclusion in batchItemFailures; otherwise they can be acknowledged out of order.
D:When the handler throws, Lambda treats the whole batch as failed, defeating the existing partial-batch feature.
Question 512
A checkout service already runs in three AZs inside one Region behind an eligible load balancer. An operational incident affects only the compute and network path in AZ-B, and on-call engineers want to temporarily divert new application traffic away from that AZ without executing multi-Region DNS failover. Healthy AZs have spare capacity. Which recovery control fits?
- Enable ARC zonal shift on the supported load balancer and start a time-limited shift away from AZ-B after verifying sufficient healthy-AZ target capacity.
- Update the Route 53 ARC multi-Region routing-control state, since an AZ impairment always requires failing over the entire AWS Region.
- Disable all load balancer health checks and wait for clients to choose AZs randomly, with no controlled traffic shift.
- Move S3 objects to another storage class, which automatically shifts application network requests out of the impaired AZ.
Explanation
Correct Answer
A:ARC zonal shift can temporarily stop new supported load-balancer traffic to one impaired AZ while other AZs serve requests; prerequisites include explicit resource integration and pre-scaled healthy capacity.
Incorrect Answers
B:Region-level routing controls manage broader regional recovery and needlessly relocate all traffic when the stated failure is AZ-specific.
C:Removing health checks prevents evidence-based routing and does not deliberately isolate the impaired AZ.
D:Object lifecycle policies cannot shift load balancer traffic between AZs.
Question 513
A disaster-recovery simulation discovers that critical recovery infrastructure has not been deployed in the standby Region, even though backup copies exist. Leaders want continuous resilience posture analysis against stated RTO/RPO policy and actionable recommendations. Which AWS service should be evaluated?
- Rely solely on AWS Backup report-plan compliance and infer that all missing compute, routing and regional application roles are fully recoverable.
- Increase backup retention indefinitely but never specify a recovery Region or test infrastructure reconstitution.
- Create CloudWatch dashboards for ordinary CPU and memory but never model application dependencies against its resilience policy.
- Use AWS Resilience Hub to assess supported application resources against a defined resilience policy and remediate identified gaps.
Explanation
Correct Answer
D:Resilience Hub evaluates application resilience posture and recommends improvements rather than equating backups alone with recoverability.
Incorrect Answers
A:Backup policy evidence cannot evaluate the whole declared application RTO/RPO resilience posture or replace the missing recovery stack.
B:Backup history does not create the missing secondary infrastructure or validate recovery timing.
C:Metrics support monitoring but are not a supported full-application resilience policy assessment with SOP and test recommendations.
Question 514
A platform wants to validate whether a critical three-AZ service continues operating during one AZ impairment. Prior planning relied on diagrams but never tested instance termination and network disruption. What experimental method addresses that gap?
- Disable CloudWatch monitoring during the test so no incident team can detect a real problem.
- Run synthetic canaries against an always-healthy status page but never inject the AZ instance and network faults under examination.
- Run a controlled AWS Fault Injection Service experiment with approved targets, stop conditions, and recovery measurements.
- Terminate every application instance across all three AZs simultaneously without monitoring stop conditions or an incident rollback plan.
Explanation
Correct Answer
C:Fault-injection experiments can safely test real resilience assumptions when blast radius and rollback safeguards are explicit.
Incorrect Answers
A:Suppressing telemetry defeats measurement of user impact and abort criteria.
B:Synthetic checks can complement testing but do not prove that the actual multi-AZ service survives injected failures.
D:An uncontrolled destructive outage does not test the specified one-AZ failure or establish safe recovery bounds.
Question 515
An Application Load Balancer terminates connections to old ECS tasks immediately when a rolling deployment starts. In-flight uploads sometimes fail despite the new tasks being healthy. Which de-registration behavior should be tuned?
- Force the client timeout to one millisecond without providing a draining or retry mechanism.
- Configure appropriate target-group deregistration delay and application graceful shutdown so active requests drain safely.
- Disable all task readiness checks and have the load balancer route to every terminating target indefinitely.
- Increase the ECS desired task count but keep target group deregistration delay at zero and force-terminate old sockets during uploads.
Explanation
Correct Answer
B:Connection draining allows in-flight requests time to finish before targets are fully removed from routing during updates.
Incorrect Answers
A:Shorter client timeouts increase visible failures rather than allowing uploads to complete.
C:Unhealthy and terminating targets should not accept new requests, regardless of existing connection handling.
D:More new tasks do not preserve in-flight connections to the old tasks while they drain.
Question 516
A machine-learning team needs a compatible GPU EC2 family for one precisely scheduled 48-hour model-training run four weeks from now in a supported Region. It does not need the GPU fleet afterward, requires planned capacity availability, and can explicitly target a reservation that expires automatically. Which capacity product should be evaluated rather than a general ongoing On-Demand reservation?
- Purchase EC2 Reserved Instances expecting the pricing discount by itself to guarantee GPU availability in the specified scheduled future window.
- Reserve an eligible Amazon EC2 Capacity Block for ML covering the training window and launch compatible GPU instances against the block.
- Use Spot-only accelerator capacity and assume placement capacity is guaranteed four weeks ahead without purchasing a future reservation.
- Increase the EC2 service quota alone and assume quota headroom obligates AWS to provide physical GPU capacity on the event date.
Explanation
Correct Answer
B:EC2 Capacity Blocks for ML reserve eligible accelerator capacity for a scheduled finite-duration period in supported configurations.
Incorrect Answers
A:Reserved Instance billing discounts do not inherently establish a short, fixed future GPU capacity reservation for a particular training window.
C:Spot capacity can be interrupted or unavailable and is not an advance fixed-duration accelerator reservation.
D:A higher quota authorizes more requests but does not reserve underlying physical capacity for a specific window.
Question 517
A production Auto Scaling group uses Spot Instances for all API serving capacity. An interruption notice removes several hosts simultaneously and customers experience errors before replacements start. The application needs a stable minimum capacity even during market shortages. Which policy is most suitable?
- Increase the maximum Spot price above market limits and assume a Spot instance never receives interruption notices.
- Provide a required On-Demand base capacity and diversified Spot pools, with graceful draining and replacement handling.
- Configure the fleet for one Spot allocation pool only and assume all interruption warnings can be ignored.
- Keep every workload instance on Spot and increase the target group deregistration delay, asserting this reserves a noninterruptible minimum compute baseline.
Explanation
Correct Answer
B:An On-Demand baseline reduces reliance on interruption-prone capacity while diversification and lifecycle controls soften Spot removals.
Incorrect Answers
A:Being willing to pay more does not convert Spot into guaranteed continuously available reserved capacity.
C:Single-pool Spot reliance increases correlated market risk for the required stable capacity.
D:Connection draining may soften interruption effects but cannot create the On-Demand baseline the workload needs during scarce Spot capacity.
Question 518
An ecommerce API accepts payment requests at least once and uses client retries during transient timeouts. Occasionally the same order is charged twice because the first request committed even though its response was lost. What application reliability mechanism prevents duplicate side effects?
- Set an SQS FIFO deduplication ID as the sole guarantee for a payment request retried hours later after the queue deduplication window.
- Use an idempotency key scoped to the intended payment transaction and enforce atomic deduplication before charging.
- Increase request timeout values without persisting any record of previously completed transaction identifiers.
- Return the prior HTTP 200 response from an API cache without a durable atomic record of whether the card was actually charged.
Explanation
Correct Answer
B:An idempotency key ensures retried requests map to one business action even when the client cannot know whether a prior response was lost.
Incorrect Answers
A:Queue deduplication windows are finite and do not replace durable payment-side idempotency across late retries.
C:Timeout tuning cannot distinguish a replay from an initial successful charge with a lost acknowledgment.
D:A response cache cannot safely prove the payment effect occurred exactly once without a transaction-key record around the side effect.
Question 519
A DynamoDB-backed service accidentally deletes a subset of recent records when a faulty batch job runs. The team wants to restore an exact prior point without depending on periodic weekly exports. What database protection should have been configured?
- Enable only a Global Secondary Index and assume deleting base-table records leaves untouched backup copies in the index.
- Increase provisioned write capacity to prevent users from deleting existing rows.
- Configure a CloudWatch alarm for high write units and assume the alarm snapshot can restore recently deleted DynamoDB items.
- Enable DynamoDB point-in-time recovery and restore the table to a selected supported recovery timestamp when needed.
Explanation
Correct Answer
D:PITR permits recovery to a recent point within the continuous backup retention window, mitigating accidental logical deletions.
Incorrect Answers
A:Indexes reflect base-table changes and are not historical independent backup copies.
B:Throughput provisioning affects capacity but cannot prevent a successfully authorized mistaken delete.
C:A capacity alarm cannot reconstruct item state at a prior timestamp; point-in-time recovery is the relevant backup mechanism.
Question 520
An EventBridge rule already has an SQS standard dead-letter queue for failures delivering audit events to Lambda. During a drill, the target fails as expected but the encrypted DLQ receives nothing; metrics indicate failed DLQ delivery. The queue is in the rule Region and uses a customer-managed KMS key, and the team has not configured its queue resource policy or KMS service permissions. What configuration repair is required?
- Grant the EventBridge service scoped sqs:SendMessage access in the DLQ resource policy and the required KMS data-key/decrypt use on the customer-managed key, then retest failed deliveries.
- Allow sqs:SendMessage to Lambda’s execution role alone, leaving the EventBridge service principal unable to deliver to the encrypted DLQ.
- Convert the target DLQ to FIFO without changing access policies, because EventBridge always requires FIFO DLQs for ordered replay.
- Use an AWS-managed SQS key on a different queue while leaving the actual configured customer-key-encrypted rule DLQ policy unchanged.
Explanation
Correct Answer
A:A rule-target DLQ requires a queue policy permitting EventBridge delivery and, when encrypted with a customer-managed KMS key, suitable KMS permissions for the service principal.
Incorrect Answers
B:The EventBridge service, not the target function execution role, sends the failed invocation to the rule DLQ and needs access to SQS and KMS.
C:EventBridge rule target dead-letter queues use standard SQS queues, and changing queue type would not fix missing SQS or KMS authorization.
D:Fixing another queue does not grant EventBridge permission to write or encrypt messages in the intended dead-letter queue.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests