Free SAP-C02 flashcards

How can a team preview the exact resource actions, including forced replacements, of an AWS CloudFormation stack update before any change is applied?

Create a CloudFormation change set from the revised template. The change set compares the running stack to the proposed template and lists each resource with its planned action and a flag showing whether the update forces a replacement. This lets the team see, for example, that a database would be replaced, gate the release on sign-off, and only then execute the change set. Nothing is applied until execution.

In CloudFormation, which two resource attributes together preserve a stateful database through a forced replacement and through a rollback that would otherwise delete it?

Set DeletionPolicy of Retain and UpdateReplacePolicy of Retain on the resource. UpdateReplacePolicy Retain keeps the prior database when an update forces a replacement, and DeletionPolicy Retain keeps the resource when CloudFormation would otherwise delete it, such as when a failed update rolls back a newly created resource. Together they preserve the database and its data while the stack stays managed.

Common misconceptionThat termination protection keeps a database's data safe through a forced replacement. It only blocks deleting the whole stack; Retain policies protect the resource itself.

How can a vendor expose one private API to many customer accounts that have overlapping CIDRs, with no transitive path back into customer networks?

AWS PrivateLink publishes the single API behind a Network Load Balancer as an endpoint service, and each customer reaches it through an interface endpoint mapped to a local ENI in their own VPC. Connectivity is service-level, not IP routing, so overlapping CIDR ranges do not matter, only that one service is reachable, and there is no transitive route back into either network.

What is the most scalable way to give hundreds of VPCs across many accounts transitive any-to-any routing with centrally controlled route propagation?

AWS Transit Gateway is a regional routing hub that every VPC attaches to, providing transitive routing without a quadratic mesh of links. Shared through AWS Resource Access Manager, accounts across the organisation can attach, and Transit Gateway route tables centrally decide which attachments propagate routes to which. It scales to thousands of attachments.

Common misconceptionThat a full mesh of VPC peering scales to many VPCs. Peering is non-transitive, so the link count grows roughly with the square of VPC count.

How can application logs from many Amazon ECS microservices across several accounts be centralised for low-cost ad hoc cross-service queries?

Use Amazon CloudWatch Logs subscription filters to stream each log group in near real time to a destination log group in a central account, then query the consolidated data with CloudWatch Logs Insights. Per-group retention satisfies multi-year storage, and there are no search clusters or export pipelines to operate.

How can an unhealthy Amazon EC2 instance be rebooted automatically the moment it fails, with no added servers and no custom code?

Create an Amazon CloudWatch alarm on the StatusCheckFailed metric and attach a built-in EC2 recovery alarm action that reboots the instance as soon as the alarm enters the ALARM state. The native action fires the instant the status check fails, so recovery is automatic and there is nothing for the team to maintain.

Common misconceptionThat paging an on-call engineer counts as automated recovery. A human must still act, so the outage continues until they do.

In the 7Rs migration framework, which strategies fit a per-server licensed packaged ERP suite and a self-hosted SQL Server estate moving to a managed engine?

Repurchase fits licensed or packaged software dropped for a SaaS or different commercial product, which suits a per-server ERP suite. Replatform is a lift-and-optimise that swaps a self-managed component for a managed equivalent, such as moving self-hosted SQL Server onto Amazon RDS without rewriting the application.

Which AWS service delivers the fastest, lowest-risk rehost of around 200 whole VMs with minutes of cutover downtime and no application or OS changes?

AWS Application Migration Service replicates entire source servers at block level into a staging subnet, keeps them in sync while non-disruptive test launches validate them, then converts and boots production instances in a cutover lasting minutes, needing no application or OS changes.

Common misconceptionThat rewriting an application into containers is always the safer, more future-proof choice, even under a hard deadline a full rewrite cannot meet.