SAP-C02 Practice Test 17 — 15 Questions

Question 1

A company has a complex AWS environment with multiple VPCs connected via a transit gateway. The company wants to centrally manage DNS resolution across all VPCs. Currently, each VPC has its own Amazon Route 53 private hosted zone. The company needs a solution that allows resources in any VPC to resolve DNS names from any other VPC's private hosted zone. Which solution should be implemented?

Accepted Answer

Use Route 53 Resolver outbound endpoints and forwarding rules to forward DNS queries to the appropriate private hosted zones.. Option B is correct because Route 53 Resolver outbound endpoints allow you to forward DNS queries from your VPCs to custom DNS resolvers or to other private hosted zones. By creating outbound endpoints and forwarding rules, you can centrally route DNS queries from any VPC to the appropriate private hosted zone associated with another VPC, enabling cross-VPC DNS resolution without requiring VPC peering or complex associations.

Answer

Create VPC peering connections between all VPCs and enable the 'Allow DNS resolution from peered VPC' option.

Answer

Configure Route 53 Resolver inbound endpoints in each VPC and set up conditional forwarding.

Answer

Associate each private hosted zone with each VPC using Route 53.

Question 2

A company needs to design a new solution for storing and retrieving user-uploaded images. The images are accessed frequently for the first 30 days and then rarely accessed after that. The company wants to minimize storage costs while maintaining low-latency access for frequently accessed images. Which storage strategy should be used?

Accepted Answer

Store images in Amazon S3 Standard and use lifecycle policies to transition to S3 Standard-IA after 30 days.. Amazon S3 Standard provides low-latency access for frequently accessed images, and S3 lifecycle policies allow automatic transition to S3 Standard-Infrequent Access (Standard-IA) after 30 days, reducing storage costs while maintaining rapid access for the initial period. This strategy directly meets the requirement of minimizing costs without sacrificing performance for the first 30 days.

Answer

Store images in Amazon EBS volumes attached to a web server.

Answer

Store all images in Amazon S3 Glacier Flexible Retrieval.

Answer

Store all images in Amazon S3 Standard.

Question 3

A company is designing a web application that must support millions of concurrent users. The application uses a RESTful API frontend and a relational database backend. Which TWO strategies should be implemented to improve scalability?

Accepted Answer

Implement read replicas for the database.. Read replicas (Option C) offload read traffic from the primary database instance, allowing the relational database to handle a higher volume of concurrent read queries without degrading write performance. This directly improves scalability for read-heavy workloads common in web applications.

Answer

Use Amazon SQS to queue database write requests.

Answer

Use sticky sessions (session affinity) on the load balancer.

Answer

Use a single large EC2 instance for the database.

Question 4

A company is designing a new data lake solution on AWS using Amazon S3 as the storage layer. The data lake will be used by multiple teams for analytics and machine learning. The company needs to enforce fine-grained access control at the object level, enable auditing of data access, and ensure that sensitive data is masked for unauthorized users. Which combination of AWS services should be used?

Accepted Answer

Use AWS Lake Formation for fine-grained access control and auditing, and Amazon S3 Object Lambda to mask data on the fly.. Option D is correct because AWS Lake Formation provides fine-grained access control at the column, row, and cell level for data in S3, and it integrates with AWS CloudTrail for auditing data access. Amazon S3 Object Lambda can transform data on the fly, such as masking sensitive fields, before returning it to the requester, meeting the requirement to mask data for unauthorized users.

Answer

Use S3 bucket policies and S3 access logs for auditing.

Answer

Use Amazon Macie to discover sensitive data and apply S3 bucket policies to restrict access.

Answer

Use IAM policies with condition keys and enable AWS CloudTrail for auditing.

Question 5

A company is designing a new container-based application using Amazon EKS. The application requires persistent storage for stateful workloads, such as databases. The storage must be highly available and durable across multiple Availability Zones. Which storage solution should be used?

Accepted Answer

Use Amazon EFS with the EFS CSI driver.. Amazon EFS provides a fully managed, elastic NFS file system that is accessible from multiple Amazon EKS worker nodes across different Availability Zones simultaneously. The EFS CSI driver enables Kubernetes pods to mount EFS as a persistent volume, delivering the required high availability and durability for stateful workloads like databases without single-AZ dependency.

Answer

Use Amazon EBS volumes with the EBS CSI driver.

Answer

Use Amazon FSx for Lustre as a shared file system.

Answer

Use Amazon S3 with the S3 CSI driver.

Question 6

A company is designing a new serverless application that processes orders from an e-commerce website. The application uses AWS Lambda functions that are invoked by Amazon API Gateway. The company expects a sudden spike in traffic during a flash sale. Which TWO strategies should be used to ensure the application can handle the spike without errors? (Choose two.)

Accepted Answer

Set Lambda reserved concurrency to a value that matches the expected peak load.. Option A is correct because Lambda reserved concurrency guarantees a fixed number of concurrent executions for the function, preventing it from being throttled by other functions in the account. By setting reserved concurrency to match the expected peak load, the application ensures that all requests during the flash sale can be processed without hitting account-level concurrency limits.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Use Amazon SQS to buffer requests and decouple the frontend.

Answer

Configure Lambda provisioned concurrency to pre-warm instances.

Question 7

A company is designing a new microservices application on AWS. Each microservice will be deployed as a containerized application using Amazon ECS with Fargate launch type. The company expects variable traffic patterns and needs to ensure that the application can scale automatically based on demand. Which scaling solution should be used?

Accepted Answer

Configure Application Auto Scaling with a target tracking scaling policy based on average CPU utilization.. Amazon ECS with Fargate uses Application Auto Scaling to automatically adjust the desired count of tasks based on demand. A target tracking scaling policy based on average CPU utilization is the correct approach because it allows you to define a target value (e.g., 70% CPU) and Application Auto Scaling will add or remove tasks to maintain that target, matching the variable traffic patterns described.

Answer

Use Amazon EC2 Auto Scaling to add more Fargate tasks.

Answer

Use AWS Auto Scaling Plans with predictive scaling.

Answer

Manually adjust the desired count of tasks in the ECS service based on traffic analysis.

Question 8

A company is designing a new solution to securely store and manage secrets for applications running on AWS. The secrets include database credentials, API keys, and OAuth tokens. The solution must automatically rotate secrets and integrate with AWS services like Amazon RDS. Which AWS service should be used?

Accepted Answer

Use AWS Secrets Manager to store secrets and configure automatic rotation.. AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating secrets such as database credentials, API keys, and OAuth tokens. It provides native integration with Amazon RDS, enabling automatic rotation of RDS credentials without custom code, which directly meets the requirements for automatic rotation and AWS service integration.

Answer

Store secrets in AWS Systems Manager Parameter Store with a SecureString parameter type.

Answer

Use AWS CloudHSM to store secrets as keys.

Answer

Use AWS Key Management Service (KMS) to store secrets as encrypted data keys.

Question 9

A company is designing a new event-driven architecture using AWS services. The system must process events from multiple sources, filter and route events to different consumers, and ensure that events are processed exactly once. Which THREE services should be used to build this architecture? (Choose three.)

Accepted Answer

AWS Lambda functions to consume events from queues and process them.. AWS Lambda functions are correct because they can be triggered by Amazon SQS FIFO queues to process messages one at a time, preserving the order and enabling idempotent processing. Lambda integrates natively with SQS, automatically scaling the number of concurrent executions based on the queue depth, which supports the exactly-once processing requirement when combined with FIFO queues.

Answer

Amazon Kinesis Data Firehose to deliver events to destinations.

Answer

AWS AppSync to provide real-time subscriptions for events.

Question 10

A company is designing a microservices architecture on AWS ECS with Fargate. Each service needs to store and retrieve session state. The solution must be highly available and low latency. Which AWS service should be used for session state storage?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides an in-memory data store with sub-millisecond latency, ideal for session state storage in a microservices architecture. Redis supports data structures like hashes and strings that map directly to session data patterns, and its replication and cluster modes ensure high availability across multiple Availability Zones. Fargate tasks can connect to ElastiCache via private subnets, maintaining low latency without the overhead of disk-based I/O.

Answer

Amazon RDS for MySQL

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 11

A company is migrating a monolithic application to a serverless architecture using AWS Lambda. The application reads and writes to an Amazon RDS for PostgreSQL database. The database connection pool is exhausted during peak traffic. Which design change should a solutions architect recommend to avoid connection exhaustion?

Accepted Answer

Use Amazon RDS Proxy to pool and share database connections.. Amazon RDS Proxy sits between the Lambda function and the RDS database, managing a pool of database connections and reusing them across multiple invocations. This prevents the Lambda function from exhausting the database connection pool during traffic spikes, as each Lambda instance does not need to open its own connection. RDS Proxy also handles connection multiplexing and reduces the overhead of establishing new connections.

Answer

Use Amazon SQS to buffer write requests to the database.

Answer

Use DynamoDB Accelerator (DAX) as a caching layer.

Answer

Increase the max_connections parameter in the RDS parameter group.

Question 12

A company wants to decouple a frontend API from backend processing to improve scalability and fault tolerance. The frontend sends requests that can be processed asynchronously. Which AWS service should be used to decouple the components?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the frontend API from backend processing. The frontend can send requests to an SQS queue, and backend consumers can poll and process messages asynchronously, which improves scalability by buffering traffic spikes and enhances fault tolerance by persisting messages until they are successfully processed.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 13

A company is designing a new serverless application using AWS Lambda. The function must process a file uploaded to S3 and then send a notification to an external API. The external API has a rate limit of 10 requests per second. Which approach should they use to handle throttling?

Accepted Answer

Use Amazon SQS to buffer the requests and set a Lambda reserved concurrency to limit the processing rate. Option D is correct because using SQS as a dead-letter queue with a Lambda reserved concurrency and a throttle can control the rate. Option A is wrong because increasing timeout does not handle rate limiting. Option B is wrong because SNS does not provide rate control. Option C is wrong because Lambda destination on failure alone does not throttle.

Answer

Increase the Lambda function timeout and retry on failure

Answer

Configure a Lambda function destination on failure to reprocess

Answer

Use Amazon SNS to fan out the notification to multiple Lambda functions

Question 14

A company is building a serverless application using AWS Lambda. The function needs to access a private Amazon RDS MySQL database. The Lambda function and the RDS instance are in the same VPC. What is the correct way to configure the Lambda function to connect to the database?

Accepted Answer

Configure the Lambda function to run in the same VPC, subnets, and security group as the RDS instance.. Option A is correct because Lambda functions in a VPC must be configured with the same VPC, subnets, and security group as the RDS instance to establish direct network connectivity. By placing the Lambda function in the same security group, you can allow inbound traffic from the security group itself (self-referencing rule) or explicitly open the database port (e.g., 3306 for MySQL) to the Lambda's security group. This ensures traffic stays within the VPC and does not traverse the internet, meeting security and latency requirements.

Answer

Use a NAT Gateway to allow Lambda to access RDS through the internet.

Answer

Assign an IAM role that allows Lambda to access RDS and configure the security group to allow traffic from the Lambda service.

Answer

Attach an Elastic Network Interface (ENI) to the Lambda function in the same subnet as the RDS instance.

Question 15

A data analytics company is building a real-time streaming pipeline using Amazon Kinesis Data Streams. The data is consumed by multiple consumer applications, each with different processing requirements. The company wants to ensure that each consumer can process records independently without affecting others and can reprocess data from a specific point in time. Which feature should the company use?

Accepted Answer

Use Enhanced Fan-Out with a timestamp to start reading.. Enhanced Fan-Out (EFO) provides each consumer with a dedicated 2 MB/second read throughput per shard, ensuring independent processing without contention. By using the SubscribeToShard API with a starting position specified via a timestamp, consumers can reprocess data from a specific point in time, meeting the requirement exactly.

Answer

Increase the data retention period to 365 days.

Answer

Use resharding to increase the number of shards.

Answer

Use the Kinesis Client Library (KCL) with checkpointing.