SAP-C02 Design for New Solutions — 20 Questions

Question 1

A company wants to migrate a monolithic application to AWS and redesign it using microservices. The application uses a MySQL database. The company wants to minimize operational overhead and enable each microservice to have its own database. Which AWS service should the company use to implement the database layer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon RDS for MySQL. Amazon RDS for MySQL is the correct choice because it provides a managed MySQL database service that minimizes operational overhead through automated backups, patching, and scaling. Each microservice can have its own RDS instance, enabling database-per-service isolation while offloading administrative tasks like replication and failover to AWS.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon Aurora

Question 2

A company is designing a serverless application using AWS Lambda functions. The application processes events from an Amazon SQS queue. The company wants to ensure that the Lambda function can scale to handle a sudden increase in messages without losing any messages. The Lambda function must process each message at least once. Which configuration should the company use?

Accepted Answer

Configure the SQS queue as a Lambda event source with a reserved concurrency of 1000 for the Lambda function.. Configuring the SQS queue as a Lambda event source with a reserved concurrency of 1000 ensures that Lambda can scale up to 1000 concurrent executions to handle a sudden burst of messages. The SQS event source uses long polling and synchronously invokes Lambda, which processes messages in batches and automatically deletes them from the queue only upon successful completion, guaranteeing at-least-once processing. Reserved concurrency prevents throttling and ensures that the function has sufficient capacity to scale without losing messages.

Answer

Configure the SQS queue to invoke the Lambda function asynchronously and set the Lambda function timeout to 5 minutes.

Answer

Set the SQS queue visibility timeout to 30 seconds and the Lambda batch size to 100. Configure a dead-letter queue for failed messages.

Answer

Use an SQS FIFO queue with a Lambda function that has a reserved concurrency of 1.

Question 3

A company is designing a multi-account AWS environment using AWS Organizations. The company has several business units that each require their own VPC in shared accounts managed centrally. The company wants to enable VPC sharing to allow business units to create resources in shared subnets while maintaining network isolation. Which combination of steps should the company take to achieve this? (Choose TWO.)

Accepted Answer

Create a resource share in AWS Resource Access Manager (RAM) for the shared VPC subnets.. Option A is correct because VPC sharing is implemented through AWS Resource Access Manager (RAM): the VPC owner creates a resource share that includes the specific subnets (and optionally the VPC) and associates it with the participant accounts or organizational units, which lets those accounts launch resources into the shared subnets while the owner retains control of the VPC and its routing. Option B is correct because a transit gateway attached to the shared VPC and to each business unit's VPC provides the required connectivity and routing between the business units' own VPCs and the shared VPC, and it centralizes and isolates inter-VPC traffic through separate attachments and route tables. Option C is incorrect because VPC endpoints (interface or gateway endpoints) only provide private access to supported AWS services or service-based resources, not to subnets in another VPC. Option D is incorrect because VPC peering connects whole VPCs and does not enable the shared-subnet resource-creation model of VPC sharing, and it does not scale as cleanly as a transit gateway for many business units. Option E is incorrect because AWS PrivateLink exposes specific services via endpoint services and Network Load Balancers, not shared subnets for general resource creation.

Answer

Configure VPC endpoints in each business unit VPC to access the shared VPC.

Answer

Create VPC peering connections between the shared VPC and each business unit's VPC.

Answer

Use AWS PrivateLink to connect the business unit VPCs to the shared VPC.

Question 4

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 1 hour and the recovery point objective (RPO) is 15 minutes. Which combination of steps should the company take to meet these requirements? (Choose THREE.)

Accepted Answer

Use Amazon Route 53 health checks to monitor the primary application and configure DNS failover to the secondary Region.. Option A is correct because Route 53 health checks with DNS failover automatically redirect traffic to the secondary Region when the primary application becomes unhealthy, which is essential for meeting the 1-hour RTO during a regional disaster. Option D is correct because copying an AMI to the secondary Region and using an Auto Scaling group to launch instances from it provides a pre-provisioned, rapidly deployable compute tier in the DR Region, enabling recovery within the RTO. Option E is correct because a cross-Region read replica of the RDS for MySQL database continuously replicates data to the secondary Region, and with MySQL asynchronous replication the lag can be kept within the 15-minute RPO. Option B is not correct because Multi-AZ only provides high availability within a single Region and does not protect against a Region-wide failure, so it does not satisfy the cross-Region DR requirement. Option C is not correct because the application already uses Amazon RDS for MySQL, and migrating to Aurora Global Database would require an engine change and is not a step to add to the existing RDS MySQL architecture.

Answer

Configure a Multi-AZ deployment for the RDS database in the primary Region.

Answer

Deploy the application on Amazon Aurora Global Database.

Question 5

A company is designing a serverless data processing pipeline using AWS Step Functions, AWS Lambda, and Amazon DynamoDB. The pipeline must process incoming JSON records from an Amazon Kinesis Data Stream. Each record must be processed exactly once and in order. The company expects a throughput of up to 1,000 records per second. Which combination of services and configurations should the company use to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the Kinesis Data Stream with 10 shards.. Option C is correct because a Kinesis Data Stream shard supports up to 1,000 records per second for writes, so 10 shards provide the required 1,000 records/second throughput (10 × 1,000 = 10,000 records/sec capacity, comfortably meeting the requirement). Option E is correct because Kinesis guarantees ordering per shard, and processing records from each shard sequentially with a batch size of 1 ensures records are handled in order without concurrent processing of the same shard's records. Option A is incorrect because DynamoDB Streams is a change-data-capture mechanism for DynamoDB tables, not a way to ingest records from Kinesis, and it does not provide the required ordering/exactly-once semantics for this pipeline. Option B is incorrect because an SQS FIFO queue is not the native event source for Kinesis records and would not preserve the Kinesis shard-level ordering required here. Option D is incorrect because Step Functions does not by itself guarantee exactly-once delivery of Kinesis records; exactly-once processing must be handled at the consumer/Lambda level (e.g., idempotency), and Step Functions is not the mechanism that delivers Kinesis records to Lambda.

Answer

Use DynamoDB Streams to trigger the Lambda function for each record.

Answer

Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.

Answer

Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.

Question 6

A company is designing a new application that will be deployed on Amazon ECS with Fargate launch type. The application needs to store configuration data, including database connection strings, that must be encrypted at rest. The company wants to follow best practices for managing secrets. Which solution should the company use?

Accepted Answer

Store the secrets in AWS Secrets Manager and reference them in the ECS task definition.. AWS Secrets Manager is the recommended service for storing sensitive configuration data like database connection strings because it provides built-in encryption at rest using AWS KMS, automatic secret rotation, and fine-grained access control. ECS task definitions can reference Secrets Manager secrets directly using the 'secrets' parameter, which injects the secret value into the container at runtime without exposing it in plaintext. This approach follows AWS best practices for managing secrets by avoiding hard-coded values and leveraging a dedicated secrets management service.

Answer

Store the configuration data in an S3 bucket with server-side encryption (SSE-S3) and download it at container startup.

Answer

Store the secrets in AWS Systems Manager Parameter Store (SecureString) and reference them in the ECS task definition.

Answer

Store the configuration data in environment variables in the ECS task definition.

Question 7

A company is designing a serverless application using AWS Lambda for business logic and Amazon API Gateway for REST APIs. The application needs to store and retrieve user session data. Which service should they use for session state?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice for storing user session state in a serverless application with Lambda and API Gateway. DynamoDB is serverless, fully managed, and scales automatically, aligning with the serverless design. It supports TTL (time-to-live) for automatic session expiration, and provides single-digit millisecond latency suitable for session management. While ElastiCache offers lower latency, it requires managing cache clusters and is not serverless, contradicting the requirement.

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Answer

Amazon S3

Question 8

A company needs to design a disaster recovery (DR) solution for a critical database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 5 minutes. The primary region is us-east-1. Which solution meets these requirements?

Accepted Answer

Enable Multi-AZ deployment with a DB cluster.. A Multi-AZ DB cluster deployment for Amazon RDS for MySQL provides automatic failover to a standby instance in a different Availability Zone within the same region, achieving an RTO of typically 1–2 minutes and an RPO of effectively zero (synchronous replication). This meets the 15-minute RTO and 5-minute RPO requirements without any manual intervention or cross-region latency.

Answer

Use automated backups with 5-minute retention.

Answer

Take manual snapshots every 5 minutes and copy to another region.

Answer

Create a cross-region read replica in us-west-2.

Question 9

A company wants to design a highly available, stateless web application using Amazon ECS with Fargate. They need to distribute traffic across multiple AWS Regions for low latency. Which approach should they use?

Accepted Answer

Use Amazon Route 53 latency-based routing to direct traffic to an Application Load Balancer in each region.. Amazon Route 53 latency-based routing directs users to the region with the lowest latency, and using an Application Load Balancer (ALB) in each region provides regional traffic distribution and health checks for the stateless ECS Fargate tasks. This combination ensures high availability and low latency across multiple AWS Regions, as the ALB handles HTTP/HTTPS traffic and integrates with ECS service discovery.

Answer

Use a single Network Load Balancer in the primary region with cross-zone load balancing.

Answer

Use Amazon CloudFront with origins in each region.

Answer

Use AWS Global Accelerator with Network Load Balancers in each region.

Question 10

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Accepted Answer

AWS Certificate Manager (ACM). AWS App Mesh (D) is correct because it is a service mesh that provides Envoy-based sidecar proxies for ECS/Fargate tasks, and it natively supports mutual TLS between services via its TLS validation and certificate configuration. AWS Certificate Manager (A) is correct because ACM issues and manages the private/public certificates (or integrates with Private CA) that App Mesh uses to provision and rotate the certificates required for mTLS. AWS Cloud Map (E) is correct because it provides service discovery by maintaining a registry of service names and endpoints, which ECS service discovery and App Mesh use to resolve healthy service instances. Amazon Route 53 (B) is not selected because, although it underpins Cloud Map namespaces, it is a DNS service rather than the service-discovery mechanism itself and does not provide mTLS. AWS Direct Connect (C) is not selected because it is a dedicated network connection between on-premises and AWS, unrelated to service-to-service mTLS or discovery within an ECS cluster.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 11

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The Lambda function processes messages from an SQS queue and writes to DynamoDB. The company expects unpredictable traffic spikes and must ensure that messages are not lost. Which configuration should the company use to meet these requirements?

Accepted Answer

Use an SQS queue as a Lambda event source with reserved concurrency on the Lambda function. Using an SQS queue as a Lambda event source with reserved concurrency ensures that messages are not lost during traffic spikes. SQS acts as a durable buffer, and reserved concurrency prevents the Lambda function from being throttled, which would otherwise cause messages to remain in the queue or be sent to a dead-letter queue. This combination guarantees that every message is processed without loss, even under unpredictable load.

Answer

Enable DynamoDB Accelerator (DAX) for the Lambda function

Answer

Provisioned Concurrency on the Lambda function

Answer

Increase the SQS queue visibility timeout and retention period

Question 12

A company is designing a microservices architecture on Amazon ECS with AWS Fargate. The services need to communicate with each other using HTTP APIs. The company wants to minimize operational overhead and enable canary deployments. Which solution should the company use for service discovery and traffic routing?

Accepted Answer

Use AWS App Mesh with Envoy sidecars. AWS App Mesh with Envoy sidecars provides a service mesh that handles service discovery, traffic routing, and canary deployments at the application layer. It integrates natively with ECS Fargate, offloading operational overhead by managing traffic splitting, retries, and observability without modifying application code. This makes it ideal for microservices requiring fine-grained control over HTTP traffic routing.

Answer

Use Amazon API Gateway with VPC Link

Answer

Use an Application Load Balancer with target groups per service

Answer

Use Amazon Route 53 with weighted routing policies

Question 13

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The company wants to reduce operational overhead and achieve high availability. Which database strategy should the company adopt for the microservices?

Accepted Answer

Use a separate Amazon RDS instance for each microservice. A microservices architecture requires database isolation to ensure loose coupling, independent scaling, and fault isolation. Using a separate Amazon RDS instance for each microservice allows each team to manage its own schema, optimize queries independently, and avoid a single point of failure, which aligns with the goal of reducing operational overhead and achieving high availability.

Answer

Use Amazon RDS Proxy with a single database

Answer

Use Amazon DynamoDB for all microservices

Answer

Use a single Amazon RDS instance shared across all microservices

Question 14

A company is designing a data lake on Amazon S3 for analytics. The data is ingested from multiple sources and must be encrypted at rest. The company requires the ability to audit access to the data lake and enforce fine-grained access control based on tags. Which solution should the company choose?

Accepted Answer

Use S3 bucket policies with condition keys for tags. The correct solution uses S3 bucket policies with condition keys based on tags. S3 bucket policies can use the `s3:ExistingObjectTag` condition key to enforce fine-grained access control based on object tags. Encryption at rest is achieved using S3's default encryption (SSE-S3) or other server-side encryption options, which are independent of the access control mechanism. AWS CloudTrail with S3 data events can audit all access requests, providing the required audit trail. This combination meets all requirements: encryption at rest, tag-based fine-grained access control, and auditing.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C) and bucket policies

Answer

Use AWS Lake Formation with column-level permissions

Answer

Use S3 Object Lambda with AWS CloudTrail

Question 15

A company is designing a new application on AWS that requires a highly available and scalable web tier. The web servers must be stateless and scale automatically based on CPU utilization. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Configure an Auto Scaling group with a launch template that includes a user data script to bootstrap the web server. Option A is correct because an Auto Scaling group with a launch template provides the automatic scaling mechanism, and the user data script bootstraps each new instance so the web servers remain stateless and consistently configured without manual intervention. Option B is correct because attaching the Auto Scaling group to an Application Load Balancer distributes incoming HTTP/HTTPS traffic across the instances and integrates with health checks, enabling the highly available and scalable web tier required. Option C is not correct because lifecycle hooks are used to pause instance transitions for custom actions such as draining connections or running scripts, not to provide the core scaling or load-balancing capability. Option D is not correct because a single large EC2 instance is a single point of failure and cannot scale automatically or provide high availability. Option E is not correct because a Network Load Balancer operates at Layer 4 and, while scalable, is not the appropriate choice for a typical stateless web tier that benefits from Layer 7 HTTP/HTTPS routing and integration with Auto Scaling.

Answer

Configure lifecycle hooks in the Auto Scaling group to drain connections

Answer

Use a single large EC2 instance (e.g., c5n.18xlarge) to handle all traffic

Answer

Use a Network Load Balancer to distribute traffic to web servers

Question 16

A company is designing a new real-time analytics platform that ingests data from thousands of IoT devices. The devices send JSON messages every second to an AWS IoT Core topic. The messages must be processed and stored in Amazon S3 for long-term analysis. The processing includes enrichment by calling a third-party API to add location data. The company expects the workload to vary significantly, with peak traffic of 100,000 messages per second. The solution must be cost-effective and minimize operational overhead. The current architecture uses a Lambda function subscribed to the IoT topic, which processes each message and writes to S3. However, during initial testing, the Lambda function frequently times out due to the third-party API latency, causing message loss. What should the company do to resolve this issue while meeting all requirements?

Accepted Answer

Configure the IoT rule to write messages to an Amazon SQS queue. Then use a Lambda function with reserved concurrency to poll the queue and process messages at a controlled rate. Decoupling the ingestion from the processing using an SQS queue allows the Lambda function to poll messages at a controlled rate, preventing timeouts from third-party API latency. The SQS queue acts as a buffer, absorbing traffic spikes of up to 100,000 messages per second, and Lambda can process messages asynchronously without loss. This approach is cost-effective and minimizes operational overhead by leveraging managed services.

Answer

Increase the Lambda function timeout to 15 minutes and memory to 10240 MB

Answer

Use Amazon Kinesis Data Firehose to buffer data and write to S3, then trigger a Lambda function to enrich data asynchronously

Answer

Enable Provisioned Concurrency on the Lambda function to reduce cold starts

Question 17

A company is migrating a monolithic legacy application to a microservices architecture on AWS. The application currently uses a relational database with complex joins. The migration must minimize application changes. Which database strategy should be used for the new architecture?

Accepted Answer

Use a single Amazon RDS instance shared by all microservices.. The requirement to minimize application changes means the microservices must continue to use the same relational database with complex joins. A single shared Amazon RDS instance preserves the existing SQL queries and join logic without requiring data decomposition or API-based data access patterns, which would necessitate significant application rewrites.

Answer

Use a separate Amazon RDS instance for each microservice.

Answer

Use Amazon Aurora with RDS Proxy in front of it.

Answer

Use Amazon DynamoDB as a shared database for all microservices.

Question 18

A solutions architect is designing a new serverless application using AWS Lambda to process orders from an API Gateway endpoint and store them in DynamoDB. The architect creates the IAM role shown in the exhibit. When testing, the Lambda function fails to write to DynamoDB with an AccessDeniedException. What is the MOST likely cause?

Accepted Answer

The IAM role lacks a trust policy that allows Lambda to assume it.. The IAM role shown in the exhibit likely includes a permissions policy that grants DynamoDB write access, but it is missing a trust policy that allows the Lambda service (lambda.amazonaws.com) to assume the role. Without this trust relationship, Lambda cannot obtain temporary credentials to execute the function, resulting in an AccessDeniedException when attempting to write to DynamoDB.

Answer

The Lambda function does not have permission to create log groups.

Answer

The Lambda function is not in the same VPC as DynamoDB.

Answer

The DynamoDB table 'Orders' does not exist.

Question 19

A company is designing a new application that will process sensitive data. The application will run on Amazon ECS with Fargate. The security team requires that all data at rest be encrypted, and that encryption keys be managed by the company's own hardware security module (HSM) in an on-premises data center. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS CloudHSM to generate and store encryption keys. AWS CloudHSM provides dedicated, single-tenant HSM instances that the company can use to generate and store encryption keys in its own HSM, meeting the requirement that keys be managed by the company's own HSM in an on-premises data center (though CloudHSM is in AWS, it is customer-controlled). Option D is correct because creating an AWS KMS custom key store backed by AWS CloudHSM allows the company to use KMS for encryption operations while the key material is stored in the CloudHSM cluster, satisfying the need for customer-managed HSM-backed keys.

Answer

Configure Amazon EBS encryption using AWS KMS with a customer managed key

Answer

Enable Amazon S3 default encryption with SSE-C

Answer

Store encryption keys in AWS Certificate Manager (ACM)

Question 20

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

Accepted Answer

The application is using HTTP instead of HTTPS. The bucket policy likely includes a condition that denies requests not using HTTPS (i.e., `aws:SecureTransport`: false). The application is failing because it is using HTTP instead of HTTPS to access the S3 bucket, which violates the encryption-in-transit requirement enforced by the policy. Without HTTPS, the request is denied by the S3 service.

Answer

The application is not using the VPC endpoint

Answer

The bucket policy does not allow encryption in transit

Answer

The application is missing the required x-amz-server-side-encryption header