SAP-C02 Design for New Solutions — 30 Questions

Question 1

A company is designing a serverless application using AWS Lambda for business logic and Amazon API Gateway for REST APIs. The application needs to store and retrieve user session data. Which service should they use for session state?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice for storing user session state in a serverless application with Lambda and API Gateway. DynamoDB is serverless, fully managed, and scales automatically, aligning with the serverless design. It supports TTL (time-to-live) for automatic session expiration, and provides single-digit millisecond latency suitable for session management. While ElastiCache offers lower latency, it requires managing cache clusters and is not serverless, contradicting the requirement.

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Answer

Amazon S3

Question 2

An IAM policy is attached to an IAM role that is assumed by an EC2 instance. The EC2 instance has an IP address of 10.0.1.15. The instance is unable to download objects from the S3 bucket 'example-bucket'. What is the MOST likely cause?

Accepted Answer

The EC2 instance is using a public IP address to access S3, which does not match the 'aws:SourceIp' condition.. The IAM policy attached to the role likely includes an 'aws:SourceIp' condition that restricts access to requests originating from specific IP addresses. The EC2 instance has a private IP address (10.0.1.15). When the instance attempts to download objects from S3, the source IP address seen by AWS is the instance's private IP (if using a VPC endpoint) or its public IP (if using an internet gateway). If the policy condition requires a public IP that does not include the private IP range, the request is denied. The other options are less likely because the IAM role is attached to the instance profile (B is unlikely), and the policy may include necessary permissions for s3:GetObject but still be denied by the condition (A and C are incorrect).

Answer

The S3 bucket policy denies access to the IAM role.

Answer

The IAM role is not attached to the EC2 instance profile.

Answer

The policy lacks permissions for s3:ListBucket.

Question 3

A company is designing a multi-region active-active application using Amazon Aurora Global Database. The application must have Recovery Point Objective (RPO) of less than 1 second and Recovery Time Objective (RTO) of less than 1 minute in case of a regional failure. Which configuration meets these requirements?

Accepted Answer

Deploy a single Aurora cluster with a primary in one region and a read replica in the secondary region.. The correct configuration. Amazon Aurora Global Database uses a single primary cluster in one region with up to five read-only secondary clusters in other regions. Replication is asynchronous with typical RPO of less than 1 second, meeting the RPO requirement. For RTO, Aurora can failover to a read replica in the same region within 1 minute, but cross-region failover involves promoting a secondary cluster, which may take longer than 1 minute. However, this is the only Aurora configuration that can achieve sub-second RPO and, with careful planning, approach sub-minute RTO. Note that active-active write capability is not supported; this configuration is active-passive.

Answer

Use cross-region read replicas with synchronous replication.

Answer

Deploy Aurora Global Database with multi-master clusters in two regions.

Answer

Use Amazon DynamoDB Global Tables instead of Aurora.

Question 4

A company is building a new data lake on AWS. The data is stored in Amazon S3 and will be queried using Amazon Athena. The company wants to minimize query costs. Which S3 storage class should the company use for the data?

Accepted Answer

S3 Standard. S3 Standard is the most suitable storage class for Athena queries because it provides low-latency access with no retrieval charges. Athena query costs are based on the amount of data scanned, not on the storage class. However, other storage classes like S3 Intelligent-Tiering can incur monitoring fees and may transition data to colder tiers, resulting in retrieval costs that increase total cost of ownership. S3 Glacier Deep Archive and S3 One Zone-IA are not optimal due to retrieval delays and costs or reduced durability. Therefore, to minimize query costs, S3 Standard is the best choice among the options.

Answer

S3 Intelligent-Tiering

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 5

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The company wants to achieve a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 15 minutes. Which solution should the company use?

Accepted Answer

Deploy RDS Read Replicas in another Region and promote them during a disaster.. Cross-Region Read Replicas for Amazon RDS MySQL use asynchronous replication that typically achieves an RPO of a few seconds, meeting the 5-second requirement. Upon a disaster, the replica can be promoted to a standalone primary database, which can be completed within minutes, satisfying the 15-minute RTO. Option A is invalid because RDS Multi-AZ DB clusters do not support a standby instance in another Region for MySQL. Options B and C do not meet the RPO/RTO requirements.

Answer

Configure an RDS Multi-AZ DB cluster with a standby instance in another Region.

Answer

Use EC2 Auto Scaling to launch new instances in another Region and use an Application Load Balancer.

Answer

Take automated snapshots of the RDS instance every 5 seconds and copy them to another Region.

Question 6

A company is designing a new application that requires a highly available and durable NoSQL database. Which TWO services should be considered? (Choose TWO.)

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed, serverless, key-value and document NoSQL database designed for high availability and durability. It replicates data across multiple Availability Zones (AZs) by default and provides single-digit millisecond latency at any scale, making it ideal for highly available NoSQL workloads.

Answer

Amazon DocumentDB

Answer

Amazon Neptune

Answer

Amazon RDS

Question 7

A company runs a high-traffic e-commerce platform on AWS. The application consists of a web tier, an application tier, and a database tier using Amazon RDS for PostgreSQL with Multi-AZ. During a recent sales event, the database experienced high CPU utilization and read replicas were added to offload read traffic. However, the application team noticed that some product detail pages were showing stale data (prices and inventory levels) even though the primary database had the correct data. The application uses read replicas for read queries. The solutions architect investigated and found that the read replica lag was minimal (under 1 second). The application uses Django ORM with default transaction isolation. What is the most likely cause of the stale data?

Accepted Answer

The application is reading from read replicas, which are eventually consistent, and the data may be stale if the replica has not yet applied changes from the primary.. The issue is that read replicas in Amazon RDS operate with eventual consistency. Although the replica lag was minimal, there is still a window where a read from a replica may return data that has not yet been applied from the primary. For critical data like prices and inventory, the application should read from the primary database to ensure strong consistency. Option A is incorrect because Multi-AZ standby is for high availability, not read consistency. Option B is incorrect because connection pooling addresses connection overhead, not consistency. Option D is incorrect because storage type does not affect consistency.

Answer

The Multi-AZ standby was promoted due to a failover, causing a brief inconsistency.

Answer

The application is not using a connection pool, causing connections to be established to different replicas.

Answer

The read replica is using a different storage type (Aurora I/O-Optimized) than the primary.

Question 8

A company is designing a new microservices application on AWS. The application consists of several services that need to communicate asynchronously. One service generates orders and sends them to a processing service. The order volume can vary significantly, and the processing service must scale independently. The company wants to use a managed service to decouple the services and ensure that messages are not lost. The processing service is written in Python and runs on AWS Lambda. The solutions architect needs to design the message delivery mechanism. The architect decides to use Amazon SQS. However, the Lambda function sometimes fails to process a message due to a transient error, and the message should be retried. After a maximum of three retries, the message should be moved to a dead-letter queue for analysis. Which configuration should the architect use?

Accepted Answer

Configure the SQS queue with a visibility timeout of 6 minutes and a redrive policy with maxReceiveCount of 3, pointing to a DLQ.. Amazon SQS supports a redrive policy on the source queue with a maxReceiveCount that determines how many times a message can be received (i.e., retried) before being moved to a dead-letter queue (DLQ). When a Lambda function processes messages from SQS, the visibility timeout acts as the retry interval: if the function fails and the message becomes visible again, it is retried. Setting maxReceiveCount to 3 and specifying a DLQ ARN meets the requirement of three retries and then moving to the DLQ. Option B is correct.

Option A is incorrect because the redrive policy is configured on the source queue, not on the DLQ. The DLQ itself does not have a redrive policy to send messages back; rather, the source queue sends messages to the DLQ when the maxReceiveCount is exceeded. Also, visibility timeout is not relevant to option A.

Option C is incorrect because a 30-second visibility timeout is too short; combined with three retries, it would consume retries too quickly without allowing enough time for the Lambda function to process and potentially fail, leading to premature movement to the DLQ. A 6-minute timeout (as in option B) provides sufficient time for transient errors to be resolved.

Option D is incorrect because while setting the redrive policy on the SQS queue is correct, setting Lambda reserved concurrency to 1 unnecessarily throttles the function and is not required for the retry/DLQ behavior. The redrive policy alone handles the three retries and DLQ movement.

Answer

Configure the SQS DLQ with a redrive policy that allows messages to be sent back to the source queue after 3 retries.

Answer

Configure the SQS queue with a visibility timeout of 30 seconds and a redrive policy with maxReceiveCount of 3, pointing to a DLQ.

Answer

Configure Lambda with a reserved concurrency of 1 and set the SQS queue's redrive policy to maxReceiveCount of 3.

Question 9

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that supports the NFS protocol and must be accessible from multiple EC2 instances across different Availability Zones. The file system must provide high durability and low latency. The company also needs to control access to the file system using IAM policies. The solutions architect needs to choose the appropriate AWS storage service. Which service should the architect use?

Accepted Answer

Amazon EFS with IAM authorization.. Amazon EFS is a fully managed NFS file system that is accessible across AZs, supports IAM policies for access control, and provides high durability and low latency. Option C is correct. Option A is wrong because S3 is object storage, not a file system; S3 File Gateway presents a file interface but still uses S3 as backend. Option B is wrong because EBS volumes can only be attached to a single instance in one AZ; a cluster file system would not provide cross-AZ access. Option D is wrong because FSx for Lustre is designed for high-performance computing, not general NFS.

Answer

Amazon S3 with S3 File Gateway to present as a file system.

Answer

Amazon EBS with a Provisioned IOPS volume type, mounted on multiple instances using a cluster file system.

Answer

Amazon FSx for Lustre with a persistent deployment type.

Question 10

A company is migrating a monolithic e-commerce application to a microservices architecture on AWS. The application consists of several services that need to communicate asynchronously. The company wants to decouple the services and ensure that messages are processed exactly once and in order. The current solution uses a single Amazon SQS queue with multiple consumers, but messages are sometimes processed out of order or duplicated. The company needs a solution that guarantees order and exactly-once processing without introducing significant latency. Which approach should be used?

Accepted Answer

Use an Amazon SQS FIFO queue with a message group ID to ensure messages are processed exactly once and in order.. Amazon SQS FIFO queues guarantee exactly-once processing and preserve message order. Option A: SQS standard queues do not guarantee order or exactly-once. Option C: Amazon Kinesis Data Streams can provide ordering within a shard but does not guarantee exactly-once processing; also adds complexity. Option D: SNS FIFO topics do guarantee exactly-once delivery to subscribers like SQS FIFO queues, but using SNS with FIFO topics and SQS FIFO queues is a valid solution, though it introduces additional components and cost compared to using SQS FIFO directly. However, the question asks for a single approach, and SQS FIFO alone meets the requirements without extra complexity.

Answer

Use a single Amazon SQS standard queue with a deduplication ID to ensure each message is processed only once.

Answer

Use Amazon Kinesis Data Streams with a single shard and implement idempotent processing in the consumer.

Answer

Use Amazon SNS with a FIFO topic and subscribe SQS FIFO queues to ensure ordered delivery.

Question 11

A company is running a web application on AWS Elastic Beanstalk with an Auto Scaling group behind an Application Load Balancer. The application stores session state in an Amazon DynamoDB table. During a traffic spike, the application becomes slow and some users are logged out unexpectedly. The operations team notices that the DynamoDB table's read capacity utilization is consistently at 100%. The company needs to improve the performance of the session store without over-provisioning capacity. Which solution should be implemented?

Accepted Answer

Implement Amazon DynamoDB Accelerator (DAX) as a caching layer for the session store.. DynamoDB Accelerator (DAX) provides an in-memory cache for DynamoDB, reducing read latency and offloading read capacity without over-provisioning. Option A: Migrating to ElastiCache Memcached would require significant application changes and does not directly alleviate the DynamoDB read capacity issue. Option B: Increasing read capacity units (RCU) manually is not scalable and could lead to over-provisioning; it does not address the root cause of read spikes efficiently. Option C: Amazon SQS is a message queue service, not a session store; using it for session state would not provide low-latency access required for session management.

Answer

Migrate the session store from DynamoDB to Amazon ElastiCache Memcached.

Answer

Increase the read capacity units (RCU) of the DynamoDB table to handle peak traffic.

Answer

Move session state to Amazon SQS and have the application poll the queue.

Question 12

A company is building a new microservices architecture on AWS using Amazon ECS with Fargate. The services need to communicate with each other using RESTful APIs. The company wants to implement an API gateway to handle authentication, rate limiting, and request routing. Which AWS service should be used as the API gateway?

Accepted Answer

Amazon API Gateway. Amazon API Gateway provides authentication, rate limiting, and request routing for RESTful APIs. Option A: ALB is a load balancer, not an API gateway. Option B: CloudFront is a CDN. Option D: NLB is for TCP/UDP traffic.

Answer

Network Load Balancer

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 13

A company is designing a serverless application using AWS Lambda for business logic and Amazon API Gateway for REST APIs. The application needs to store and retrieve user session data. Which service should they use for session state?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role that allows Lambda to access the RDS instance using IAM database authentication.. Both Option A and Option C are valid methods to securely access the database without storing credentials in code. IAM database authentication (A) allows the Lambda function to authenticate using its IAM role, provided the RDS instance is configured for IAM auth. Secrets Manager (C) stores credentials and supports automatic rotation. Option B exposes credentials, and Option D lacks rotation capabilities. Therefore, both A and C are correct for this scenario.

Answer

Pass the database credentials as environment variables to the Lambda function.

Answer

Store the database credentials in AWS Systems Manager Parameter Store and retrieve them in the Lambda function.

Question 14

Refer to the exhibit. A company is designing a new solution and uses this AWS CloudFormation template to create an S3 bucket. The company wants to ensure that objects are automatically deleted after 1 year. However, the current template does not delete objects. What is the reason?

Accepted Answer

The lifecycle rule is missing a 'Filter' property.. In AWS CloudFormation, lifecycle rules for S3 buckets require either a 'Filter' or a 'Prefix' property to define the scope of the rule. While the S3 API makes 'Filter' optional, CloudFormation requires one of these properties. The template lacks both, so the rule is considered invalid and does not apply. Therefore, objects are never deleted.

Answer

The VersioningConfiguration is set to Enabled, which prevents expiration.

Answer

The rule is missing a 'Status' property.

Answer

The transition to GLACIER storage class prevents expiration from occurring.

Question 15

A company is designing a new solution to store and analyze large volumes of IoT sensor data. The data is time-series and must be retained for 90 days. The company needs to run complex SQL queries on the data and expects low latency for the most recent 7 days of data. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Kinesis Data Analytics to analyze data in real-time and store results in S3.. Uses Amazon Kinesis Data Analytics to perform real-time SQL analytics on streaming IoT sensor data, providing low-latency access to the most recent 7 days of data. The analyzed results can be stored in Amazon S3, which can retain data for 90 days, meeting the retention requirement. Option D uses Amazon Timestream, a purpose-built time-series database that automatically stores recent data in memory for low-latency queries and moves older data to a cost-optimized storage tier, with a default retention period configurable up to 90 days. Timestream supports standard SQL queries. Option B (RDS with TimescaleDB) is not serverless and requires manual scaling; it also does not natively integrate with streaming data at scale. Option C (Redshift) is not optimized for real-time ingestion or low-latency queries on recent data; its snapshot retention is for backup, not for time-series query performance. Option E (DynamoDB with TTL and PartiQL) does not efficiently support time-series analytics or complex SQL queries on large volumes of sensor data; PartiQL has limitations for analytical queries.

Answer

Use Amazon RDS for PostgreSQL with TimescaleDB extension.

Answer

Use Amazon Redshift with automated snapshot retention of 90 days.

Answer

Use Amazon DynamoDB with TTL to expire data after 90 days and use PartiQL for queries.

Question 16

A company has an S3 bucket with server-side encryption using S3-Managed Keys (SSE-S3). The IAM policy shown in the exhibit is attached to a user. When the user attempts to download an object using the AWS CLI with no encryption headers, the request fails. What is the MOST likely reason?

Accepted Answer

The policy condition requires the encryption header in the request.. The IAM policy attached to the user includes a condition that requires the presence of the x-amz-server-side-encryption header in the request, and the header value must match either aws:kms or AES256. When the user issues a download request (GetObject) via the AWS CLI without specifying any encryption header, the condition is not satisfied, and the request is denied. This is a security measure to enforce encryption in transit or to ensure that the client is aware of the encryption, even though the object is encrypted with SSE-S3. Note that for SSE-S3 objects, the x-amz-server-side-encryption header is not required on GET requests by default, but the IAM policy can still require it, causing failure if omitted.

Answer

The object is encrypted with SSE-KMS, not SSE-S3.

Answer

The user does not have the s3:GetObject permission.

Answer

The bucket has a bucket policy that denies all requests.

Question 17

A company is designing a disaster recovery solution for a critical application that runs on Amazon RDS for PostgreSQL. The application requires an RPO of 5 minutes and an RTO of 15 minutes. The primary database is in us-east-1. The recovery Region is us-west-2. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Configure a cross-Region read replica for the RDS PostgreSQL instance in us-west-2.. Both Option B and Option C meet the requirements. Option B: A cross-Region read replica for RDS PostgreSQL can be promoted to a standalone primary in minutes, satisfying the 15-minute RTO, and asynchronous replication typically has lag well under 5 minutes, meeting the 5-minute RPO. Option C: Enabling Multi-AZ ensures high availability within the primary region, but the key component for DR is the read replica in us-west-2. The combination does not prevent meeting the RPO/RTO; the read replica can be promoted quickly. Note that Multi-AZ alone does not provide cross-region DR, but when combined with a cross-Region read replica, it still meets the requirements. Option A: Manual snapshots cannot achieve 5-minute RPO due to snapshot frequency and restore times. Option D: Aurora Global Database is not supported for RDS PostgreSQL; it is for Aurora only. Option E: Automated backups provide daily snapshots, not sub-minute RPO, and cross-region copy adds delay, so RTO is too long.

Answer

Take manual snapshots periodically and copy them to us-west-2.

Answer

Use Amazon Aurora Global Database with a secondary cluster in us-west-2.

Answer

Use automated backups with cross-Region copy to us-west-2.

Question 18

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by third-party APIs. The company plans to use an Application Load Balancer with EC2 instances. Which two steps should the company take to ensure the ALB has a consistent set of IP addresses? (Choose TWO.)

Accepted Answer

Place a Network Load Balancer with Elastic IP addresses in front of the ALB.. AWS Global Accelerator provides two static IP addresses that act as a fixed entry point for traffic, which can be whitelisted by third-party APIs. It routes traffic to the ALB while preserving source IPs. Option B is also correct: placing a Network Load Balancer with Elastic IP addresses in front of the ALB provides static IPs for inbound traffic, as the NLB can be assigned Elastic IPs and forward traffic to the ALB. Option E is incorrect because AWS WAF is a web application firewall that filters traffic but does not affect IP addresses.

Answer

Use a NAT Gateway with Elastic IPs for outbound traffic.

Answer

Use Amazon Route 53 with an A record pointing to the ALB.

Answer

Associate an AWS WAF web ACL with the ALB.

Question 19

A company is deploying a web application on AWS. The application runs on EC2 instances behind an ALB. The security team requires that all traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Which THREE steps should the architect take? (Choose three.)

Accepted Answer

Configure the ALB target group to use HTTPS protocol. To encrypt traffic between the ALB and EC2 instances and restrict instance access to only the ALB, the architect must take two steps. First, configure the ALB target group to use HTTPS protocol (Option C) to encrypt traffic between the ALB and the backend instances. Second, configure the EC2 instance security group to allow inbound traffic only from the ALB's security group (Option D) to restrict access to only the ALB. The ALB listener HTTPS configuration (the null option) is for client-to-ALB encryption, which is not required by the security team's requirement; it is optional if end-to-end encryption is needed, but the question specifically asks for encryption between ALB and instances. Option A (same security group) would allow all traffic between the group members, not restrictive enough. Option B (public subnet) would expose instances directly to the internet. Option E (network ACLs) cannot reference security groups and is stateless, making it unsuitable.

Answer

Assign the same security group to the ALB and the instances

Answer

Place the EC2 instances in a public subnet

Answer

Use network ACLs to restrict inbound traffic to the ALB's IP addresses

Question 20

A company is building a data lake on Amazon S3. The data comes from various sources and must be encrypted at rest. The security policy requires that the encryption keys be managed by the company and rotated annually. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C). Server-side encryption with customer-provided keys (SSE-C) allows the company to provide and manage their own encryption keys, including annual rotation. Server-side encryption with AWS KMS using a customer managed key (SSE-KMS) also lets the company manage keys through KMS and set up automatic annual rotation. Client-side encryption with the Amazon S3 encryption client encrypts data before it is sent to S3, ensuring encryption at rest with keys managed entirely by the company, and the company can rotate the keys as needed. All three options (A, C, and E) meet the requirements for encryption at rest with company-managed keys and annual rotation. Although the stem specifies 'Choose two,' these three are valid; any two can be selected as correct answers.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Enable default encryption on the S3 bucket with SSE-S3

Answer

Use client-side encryption with the Amazon S3 encryption client