Free AWS SAP-C02 Actual Exam Questions

Makes sense to add Auto Scaling for traffic spikes, so A.

Probably F, adding AZ diversity helps if one zone fails.

Makes sense that snapshots in A and C would cause downtime since they’re point-in-time copies. B with DMS is better for keeping things synced until the cutover happens. So I’d go with B.

B. Using DMS lets you keep both clusters in sync until cutover, which really helps reduce downtime. The snapshot methods (A and C) are more of a one-time copy, so they might cause longer interruptions.

It’s A. Sticky sessions are key, and the least outstanding requests algorithm helps balance load better. Using Aurora replicas scales reads without touching the writer, so it’s more reliable for growth.

B tbh, the app needs consistent handling of session state since it's stateful, so sticky sessions are a must. Aurora writers scaling is tricky because usually only one writer is active, so auto scaling writers might not be realistic. Using an Application Load Balancer makes sense here since it supports HTTP and sticky sessions better than a Network Load Balancer. Round robin routing combined with sticky sessions should distribute load while keeping user sessions consistent. So option B fits the requirements for stateful app scaling and consistent UX better than the others.

What about option D? Snapshots seem slow for a 2-minute RPO on app state.

Global Accelerator with Elastic Disaster Recovery sounds best for quick app failover, so A.

B tbh, running everything in EKS seems like overkill here, plus managing containers and multiple regions adds complexity. A is too manual with EC2 deployment and scaling via Step Functions, which is a lot of overhead. C is out since it requires refactoring the app into Python and switching to DynamoDB, which isn’t feasible without source code. D lines up well because Elastic Beanstalk supports Java/Tomcat apps using JARs, handles autoscaling, and RDS for PostgreSQL is a managed service, reducing ops. So, D really fits the “least operational overhead” goal best despite the DB migration question

D, Elastic Beanstalk handles deployment and autoscaling without needing code changes.

Maybe C is worth considering since migrating the existing VM to EC2 with an Elastic IP gives a fixed public IP and lets you keep a familiar Linux environment. It might be simpler than setting up multiple VPC endpoints with Elastic IPs.

It’s A, since static Elastic IPs per subnet fit the static IP need better than B’s public endpoint.

Maybe D could work since it blocks known bad IPs outright, but given the IPs change weekly, it might need constant updates which isn’t very operationally efficient. That makes B more attractive since rate-based rules automatically handle traffic spikes without manual intervention. Still, if the question emphasizes preventing overload with minimal ops work, B feels like the better fit because you don’t have to manage changing IP lists all the time.

B seems best since it auto-blocks based on traffic rate, no manual IP updates needed.

C/D? Both suggest using an IAM role, which is good. D’s extra external ID makes sense for security, but the question doesn’t say it’s required. C might still be acceptable if external ID isn’t specified.

Maybe D is best because the external ID helps confirm the partner’s identity and avoids unauthorized access. C misses that extra security step, so D seems safer overall.

I doubt C because EC2 instances might struggle with unpredictable spikes without a buffer, risking data loss. Does the question exclude streaming solutions like Kinesis, or is that still viable?

It’s A for me. Using an ALB directly with an SQS queue as a target group is not really supported—you can’t add an SQS queue as a target to an ALB. That alone rules out A. Between B and D, B makes more sense since the API Gateway to SQS integration is designed exactly for buffering bursty REST API traffic with zero data loss. Kinesis in D is better for streaming large volumes of data continuously, but the question focuses on RESTful API calls, so B fits better. C lacks a decoupling buffer layer, so riskier with unpredictable bursts.

B imo for sure, moving the frontend to S3 cuts costs a lot since it’s just static content and no need for EC2 there. For the backend, E makes sense because burstable instances can handle the peaks but save money during low-traffic times. Spot instances (D) are risky here since interruptions might cause downtime, which they want to avoid. Also, switching instance families (A) won’t necessarily save money if the usage pattern is uneven like this. So yeah, B and E feels like the best combo to optimize cost without losing availability.

Makes sense to offload the static frontend to S3 for cost savings, so B fits. For the backend, switching to burstable instances (E) helps with low off-peak demand without risking interruptions like Spot instances would.

D Dedicated Hosts reserve capacity just for you, so launching new instances there avoids the general AZ capacity issue. Stopping and starting instances (B) might not help if the capacity is genuinely full.

B tbh, stopping and starting instances might free up some capacity in the placement group. If the issue is just a temporary capacity shortage, this could help since instances will be relaunched possibly on different hardware. A new placement group (C) can't be merged anyway, so that’s out. Dedicated Hosts (D) seem like a bigger change and more expensive, so definitely last resort. A spread placement group (A) isn’t relevant here since it focuses on spreading instances across hardware, not solving capacity errors within a cluster placement group.

A imo, S3 is the easiest place to host a static custom error page with zero maintenance. E is good since CloudFront can serve the error page without changing ALB settings, so both make sense together.

A/E seems simplest to me, using S3 and CloudFront custom error pages.

C, because built-in S3 replication plus CloudFront origin groups automate failover smoothly.

C seems simplest—S3 replication plus CloudFront origin groups handle failover automatically.

Maybe C is worth checking since if test users aren’t in the right IdP group, they won’t get mapped to AWS roles properly. Also, E seems less relevant because AWS doesn’t need to reach the IdP’s DNS for SAML assertions.

Maybe D too, since the portal has to correctly call AssumeRoleWithSAML with the right ARNs and assertion for this to work. Without that step, users won’t get proper role access despite valid tokens.

Makes sense to keep shared libs separate, so a Lambda layer seems better than a full container—B.

D makes sense since deploying everything in one container simplifies reuse and deployment.