SAP-C02 Design for New Solutions Practice Test 10 — 15 Questions

Question 1

A company is designing a new system to ingest and process real-time streaming data from thousands of IoT devices. The system must be able to handle variable throughput and provide durable storage for the data. The data will be processed by a Lambda function and then stored in Amazon S3. Which two services should be used together to build this ingestion pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Lambda. Amazon Kinesis Data Streams (D) is correct because it is designed for ingesting large volumes of real-time streaming data from thousands of producers such as IoT devices, supports variable throughput via shards and on-demand scaling, and durably stores records for up to 24 hours by default (up to 365 days with extended retention) so consumers can read them. AWS Lambda (A) is correct because it natively integrates with Kinesis Data Streams as an event source, allowing Lambda to poll the stream, process batches of records, and then write the results to Amazon S3, which matches the stated processing and storage requirement. Amazon Kinesis Data Firehose (B) is not the right pairing here because it is a managed delivery service that loads data directly into destinations like S3, so it would not require a Lambda function to move the data to S3 and is not the streaming ingestion service intended for custom Lambda processing. Amazon SQS (C) is a message queue for decoupling applications, not a real-time streaming ingestion service with ordered, replayable stream storage, so it does not fit the streaming pipeline design. Amazon SNS (E) is a pub/sub notification service for fan-out messaging, not a durable streaming data ingestion service, so it does not meet the requirement for handling variable-throughput real-time streams.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Simple Notification Service (SNS)

Question 2

A company is designing a new data lake on AWS. The data lake will store raw data from various sources in Amazon S3. The data will be processed using AWS Glue ETL jobs and queried using Amazon Athena. To optimize costs and performance, which three practices should the solutions architect implement?

Accepted Answer

Compress data using Snappy or Gzip compression.. Compressing data with Snappy or Gzip reduces storage costs in Amazon S3 and decreases the amount of data scanned by Athena, which charges per TB scanned. Snappy offers faster decompression for ETL workloads, while Gzip provides higher compression ratios. Both are natively supported by AWS Glue and Athena, making them optimal for cost and performance.

Answer

Store data in JSON format for flexibility.

Answer

Store data in many small files to improve parallel processing.

Question 3

A company is migrating a monolithic e-commerce application to a microservices architecture on AWS. The application consists of several services that need to communicate asynchronously. The company wants to decouple the services and ensure that messages are processed exactly once and in order. The current solution uses a single Amazon SQS queue with multiple consumers, but messages are sometimes processed out of order or duplicated. The company needs a solution that guarantees order and exactly-once processing without introducing significant latency. Which approach should be used?

Accepted Answer

Use an Amazon SQS FIFO queue with a message group ID to ensure messages are processed exactly once and in order.. Amazon SQS FIFO queues guarantee exactly-once processing and preserve message order. Option A: SQS standard queues do not guarantee order or exactly-once. Option C: Amazon Kinesis Data Streams can provide ordering within a shard but does not guarantee exactly-once processing; also adds complexity. Option D: SNS FIFO topics do guarantee exactly-once delivery to subscribers like SQS FIFO queues, but using SNS with FIFO topics and SQS FIFO queues is a valid solution, though it introduces additional components and cost compared to using SQS FIFO directly. However, the question asks for a single approach, and SQS FIFO alone meets the requirements without extra complexity.

Answer

Use a single Amazon SQS standard queue with a deduplication ID to ensure each message is processed only once.

Answer

Use Amazon Kinesis Data Streams with a single shard and implement idempotent processing in the consumer.

Answer

Use Amazon SNS with a FIFO topic and subscribe SQS FIFO queues to ensure ordered delivery.

Question 4

A healthcare startup is building a HIPAA-compliant application on AWS. The application uses Amazon RDS for MySQL to store patient data. The compliance team requires that all database changes be audited, including SELECT statements. The current solution enables general query logs on the RDS instance, but the logs are stored locally and are lost when the instance is rebooted. Additionally, the logs are consuming significant storage on the instance. The startup needs a durable, scalable, and cost-effective solution for storing and querying database audit logs. Which solution meets these requirements?

Accepted Answer

Configure RDS to publish audit logs to Amazon CloudWatch Logs, then export logs to Amazon S3 using a subscription filter and Lambda. Use Athena to query the logs in S3.. The most suitable solution. RDS for MySQL supports publishing audit logs to CloudWatch Logs. From there, you can set up a subscription filter to a Lambda function that exports logs to Amazon S3 for durable storage. Athena can then be used to query the logs cost-effectively. This approach is durable, scalable, and cost-effective, meeting the compliance requirement for auditing changes including SELECT statements.

Option A: While Kinesis Data Firehose can stream to S3, enabling audit logs on RDS for MySQL does not directly integrate with Kinesis; this option is more complex and unnecessary. Option C: Storing logs in a table on RDS consumes instance storage and does not provide durable, scalable storage; logs are still lost on reboot. Option D: CloudWatch Logs Insights is not cost-effective for long-term querying of large volumes and does not offer the same query flexibility as Athena on S3.

Answer

Enable audit logs on RDS and use Amazon Kinesis Data Firehose to stream logs to Amazon S3. Use Amazon Athena to query the logs.

Answer

Enable the general query log on RDS and set the log_output to TABLE. Write a scheduled script to copy the log table to Amazon S3.

Answer

Enable audit logs on RDS and stream them to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query logs.

Question 5

A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application writes transaction logs to an Amazon EFS file system. The company needs to ensure that the logs are encrypted at rest using a customer-managed AWS KMS key. Additionally, the logs must be retained for 7 years and should not be accessible after that period. Which solution meets the encryption and retention requirements?

Accepted Answer

Enable encryption at rest on the EFS file system using a customer-managed KMS key. Use a Lambda function to copy logs to Amazon S3 and apply an S3 Lifecycle policy to expire objects after 7 years.. EFS supports encryption at rest using a customer-managed KMS key, and by copying logs to S3 and applying a lifecycle policy with expiration after 7 years, both encryption and retention requirements are met. Option A is incorrect because storing logs directly in S3 with default encryption uses S3-managed keys, not a customer-managed KMS key. Option C is incorrect because CloudWatch Logs is for real-time monitoring and not designed for long-term archival with the specified encryption and retention requirements. Option D is incorrect because enabling encryption on EFS with an AWS managed key does not meet the customer-managed KMS key requirement, and deleting logs via a cron job on EC2 instances is not reliable and may not ensure complete deletion after exactly 7 years.

Answer

Store logs directly in Amazon S3 with default encryption. Use an S3 Lifecycle policy to delete objects older than 7 years.

Answer

Use Amazon CloudWatch Logs to stream logs from the application and set a retention policy of 7 years. Enable encryption using a customer-managed KMS key.

Answer

Enable encryption at rest on the EFS file system using an AWS managed key. Use a cron job on the EC2 instances to delete logs older than 7 years.

Question 6

A company is building a new serverless application using AWS Lambda functions. The application processes images uploaded to an Amazon S3 bucket. Each image triggers a Lambda function that resizes the image and stores the result in another S3 bucket. The company expects a high volume of uploads, up to 10,000 images per minute. The current Lambda function is configured with a timeout of 5 minutes and 1024 MB of memory. During testing, the Lambda function times out for large images. What should the company do to ensure the function can process large images without timing out?

Accepted Answer

Increase the Lambda function memory to 3008 MB to get more CPU and network throughput.. Increasing Lambda memory proportionally increases CPU and network throughput, which can significantly speed up image processing, especially for large images, thereby reducing the likelihood of timeout. Option A: Increasing timeout does not address the root cause of slow processing; it only allows the function to run longer, but the function may still time out if processing is too slow. Option B: Using SQS decouples invocation but does not speed up individual function execution; it mainly helps with throttling and retries. Option C: Migrating to ECS on Fargate is not necessary; Lambda can handle this workload with sufficient memory allocation.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Use Amazon SQS to decouple the S3 event and Lambda invocation, allowing Lambda to pull messages in batches.

Answer

Migrate the image processing to Amazon ECS on Fargate with a long-running task.

Question 7

A company is designing a new application that will run on AWS. The application needs to store and retrieve user session data with low latency. The session data is small (less than 1 KB per user) and must be highly available. The company expects up to 10 million active users per day. Which AWS service should be used as the session store?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is purpose-built for sub-millisecond, low-latency access to small key-value data like session state. It supports high availability via Multi-AZ with automatic failover, and Redis replication scales reads across up to 5 replicas per shard, easily handling 10 million daily active users. Session data is ephemeral and small (<1 KB), which fits Redis's in-memory model perfectly.

Answer

Amazon DynamoDB

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 8

A company is building a new data analytics platform on AWS. The platform ingests streaming data from multiple sources, processes it in real time, and stores the results in Amazon S3 for later analysis. The data volume is expected to be up to 50 GB per day. The company needs to choose a service for real-time stream processing. Which AWS service is most appropriate for this use case?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics is the most appropriate service for real-time stream processing because it allows you to process streaming data in real time using SQL or Apache Flink. Option A (Amazon Kinesis Data Firehose) is designed for loading streaming data into data stores like S3, not for real-time processing. Option B (Amazon Kinesis Data Streams) is a data ingestion service that captures and stores data streams, but does not provide built-in processing capabilities. Option D (Amazon EMR) is primarily used for batch processing of large data sets using frameworks like Hadoop and Spark, and is not optimized for real-time stream processing.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Kinesis Data Streams

Answer

Amazon EMR

Question 9

A company is designing a new data lake on Amazon S3. The data is ingested from various sources and must be encrypted at rest. The company has a strict requirement to use an AWS KMS customer master key (CMK) that is stored in a different AWS account for additional security. The S3 bucket is in Account A, and the KMS key is in Account B. Which steps are necessary to enable server-side encryption with AWS KMS (SSE-KMS) for objects in the S3 bucket?

Accepted Answer

Update the KMS key policy in Account B to grant Account A access to the key, and update the S3 bucket policy in Account A to allow the kms:Encrypt and kms:Decrypt actions for the key.. When using an AWS KMS CMK from a different account (Account B) for SSE-KMS on an S3 bucket in Account A, you must explicitly grant Account A access to the key via the KMS key policy in Account B. Additionally, the S3 bucket policy in Account A must allow the kms:Encrypt and kms:Decrypt actions for the cross-account key, as S3 will use these permissions to encrypt and decrypt objects on behalf of the bucket owner. Without both policy updates, the cross-account KMS operation will fail with an access denied error.

Answer

Enable SSE-KMS on the S3 bucket in Account A and specify the ARN of the KMS key from Account B. S3 will automatically use the key.

Answer

Update the KMS key policy in Account B to grant Account A access to the key. No changes needed in Account A.

Answer

Update the S3 bucket policy in Account A to allow s3:PutObject with the kms:Encrypt permission. No changes needed in Account B.

Question 10

A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?

Accepted Answer

AWS Cloud Map with namespaces and service instances.. AWS Cloud Map is the correct choice because it is a cloud resource discovery service specifically designed for microservices architectures. It allows you to define custom namespaces (public, private DNS, or API-based) and register service instances with health checks. Services running on ECS with Fargate can then discover each other via DNS queries or API calls, enabling dynamic and secure communication without managing static IPs or load balancers.

Answer

AWS PrivateLink with VPC endpoint services.

Answer

Amazon Route 53 private hosted zones with DNS records for each service.

Answer

Elastic Load Balancing with internal load balancers for each service.

Question 11

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application data is stored on Amazon EBS volumes. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. Which TWO actions should the company take to meet these objectives? (Choose two.)

Accepted Answer

Configure Amazon EBS snapshots to be taken every 15 minutes.. Taking Amazon EBS snapshots every 15 minutes ensures that the RPO of 15 minutes is met, as the maximum data loss is limited to the interval between snapshots. Option E is correct because copying EBS snapshots to another AWS Region and automating their restoration into EBS volumes enables cross-region recovery, which is necessary since the application runs in a single Region and the RTO of 2 hours allows time for the restore process.

Answer

Use Amazon EBS Multi-Attach to attach volumes to instances in another region.

Answer

Use AWS Backup to create a backup plan with a daily backup.

Answer

Use AWS CloudFormation to recreate the EC2 instances from a template.

Question 12

Refer to the exhibit. An IAM policy is attached to a user. When the user tries to upload an object to the S3 bucket 'my-bucket' using the AWS CLI without specifying server-side encryption, the upload fails. What is the MOST likely reason?

Accepted Answer

The policy requires server-side encryption with AES256, but the request did not include the encryption header.. The IAM policy explicitly requires the `s3:x-amz-server-side-encryption` condition with a value of `AES256`. When the user uploads an object via the AWS CLI without specifying the `--server-side-encryption AES256` flag, the request lacks the required encryption header, causing the condition in the policy to fail and the upload to be denied. The policy does not deny all uploads without encryption—it only denies those that fail to meet the specific encryption requirement.

Answer

The bucket policy denies all uploads without encryption.

Answer

The user is not the bucket owner.

Answer

The user does not have permission to call s3:PutObject.

Question 13

Refer to the exhibit. A solutions architect is designing a new application that requires three EC2 instances running in different Availability Zones in us-east-1. The architect runs the AWS CLI command shown and sees three instances running in three AZs. However, the application is not highly available because if one AZ fails, the application loses one-third of its capacity. The architect needs to ensure that the application can survive the loss of an entire AZ without manual intervention. What should the architect do?

Accepted Answer

Create an Auto Scaling group with a minimum size of 2 and a maximum size of 6, spread across three AZs.. An Auto Scaling group with a minimum size of 2 and a maximum size of 6, spread across three Availability Zones, ensures that if one AZ fails, the Auto Scaling group automatically launches replacement instances in the remaining healthy AZs to maintain the desired capacity. This provides fault tolerance without manual intervention, as the group continuously monitors instance health and replaces failed instances across AZs.

Answer

Create a launch configuration and manually associate it with the instances.

Answer

Use EC2 Auto Recovery to automatically recover instances in case of failure.

Answer

Manually launch additional instances in other AZs.

Question 14

Refer to the exhibit. A company is designing a new solution and uses this AWS CloudFormation template to create an S3 bucket. The company wants to ensure that objects are automatically deleted after 1 year. However, the current template does not delete objects. What is the reason?

Accepted Answer

The lifecycle rule is missing a 'Filter' property.. In AWS CloudFormation, lifecycle rules for S3 buckets require either a 'Filter' or a 'Prefix' property to define the scope of the rule. While the S3 API makes 'Filter' optional, CloudFormation requires one of these properties. The template lacks both, so the rule is considered invalid and does not apply. Therefore, objects are never deleted.

Answer

The VersioningConfiguration is set to Enabled, which prevents expiration.

Answer

The rule is missing a 'Status' property.

Answer

The transition to GLACIER storage class prevents expiration from occurring.

Question 15

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that users' session data be stored durably and with low latency. The session data is accessed frequently but is rarely updated. Which solution is MOST cost-effective?

Accepted Answer

Use ElastiCache for Redis with replication.. ElastiCache for Redis with replication is the most cost-effective solution because it provides durable, low-latency session storage with built-in replication for high availability. Redis supports persistence (e.g., snapshots or AOF logs) to ensure session data survives node failures, and its in-memory nature delivers sub-millisecond latency for frequent reads with rare updates, avoiding the higher costs of DynamoDB on-demand or the lack of durability in Memcached.

Answer

Store session data in Amazon S3 with reduced redundancy.

Answer

Use DynamoDB with on-demand capacity.

Answer

Use ElastiCache for Memcached with multiple nodes.