SAP-C02 Design for New Solutions Practice Test 10 — 15 Questions

Question 1

A company is building a new data lake on AWS. The data is stored in Amazon S3 and will be queried using Amazon Athena. The company wants to minimize query costs. Which S3 storage class should the company use for the data?

Accepted Answer

S3 Intelligent-Tiering. Option B is correct because S3 Intelligent-Tiering automatically optimizes costs for data with changing access patterns. Option A is wrong because S3 Standard is for frequent access, not cost-optimized. Option C is wrong because S3 Glacier is for archival, not querying. Option D is wrong because S3 One Zone-IA is for infrequent access but lacks durability and may not be cost-effective for queries.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 2

A company is designing a new microservices architecture on AWS. The company wants to use a service mesh to manage service-to-service communication, observability, and security. Which AWS service should the company use?

Accepted Answer

AWS App Mesh. Option C is correct because AWS App Mesh is a service mesh that provides traffic management, observability, and security. Option A is wrong because Amazon API Gateway is for external APIs. Option B is wrong because AWS Cloud Map is for service discovery. Option D is wrong because AWS Transit Gateway is for network connectivity.

Answer

Amazon API Gateway

Answer

AWS Transit Gateway

Answer

AWS Cloud Map

Question 3

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The company wants to achieve a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 15 minutes. Which solution should the company use?

Accepted Answer

Configure an RDS Multi-AZ DB cluster with a standby instance in another Region.. Option D is correct because a Multi-AZ DB cluster with standby in another Region provides synchronous replication and fast failover, achieving low RPO/RTO. Option A is wrong because RDS Read Replicas are asynchronous and cross-Region replication has higher RPO. Option B is wrong because restoring from snapshots takes longer than 15 minutes. Option C is wrong because EC2 Auto Scaling groups do not handle database replication.

Answer

Use EC2 Auto Scaling to launch new instances in another Region and use an Application Load Balancer.

Answer

Take automated snapshots of the RDS instance every 5 seconds and copy them to another Region.

Answer

Deploy RDS Read Replicas in another Region and promote them during a disaster.

Question 4

A company is designing a new application that will run on Amazon EKS. The development team wants to deploy containers in a way that minimizes operational overhead. Which compute option should the company choose?

Accepted Answer

AWS Fargate. Option A is correct because Fargate is serverless and minimizes operational overhead. Option B is wrong because managed node groups still require node management. Option C is wrong because self-managed nodes have high overhead. Option D is wrong because EC2 instances require full management.

Answer

Amazon EKS managed node groups

Answer

Amazon EC2 instances

Answer

Self-managed EC2 nodes

Question 5

A company is designing a new serverless data processing pipeline. The pipeline uses AWS Lambda to process records from an Amazon Kinesis Data Stream. The company wants to ensure that failed records are automatically retried and sent to a dead-letter queue after three failed attempts. Which configuration should the company use?

Accepted Answer

Configure an on-failure destination on the Kinesis event source mapping to send records to an SQS queue.. Option B is correct because Kinesis Data Streams as a Lambda event source supports on-failure destinations for DLQ. Option A is wrong because Lambda destinations are for async invocations, not streams. Option C is wrong because DLQ is not a property of Lambda function configuration. Option D is wrong because SQS standard queue does not support retry settings like Lambda.

Answer

Configure the Kinesis stream to send failed records to an SQS standard queue.

Answer

Configure the Lambda function's dead-letter queue property with an SQS queue.

Answer

Configure a Lambda destination on the function to send events to an SQS queue.

Question 6

A company is designing a new application that requires low-latency access to a shared dataset across multiple EC2 instances in the same AWS Region. The dataset is updated frequently. Which storage solution should the company use?

Accepted Answer

Amazon EFS. Option C is correct because Amazon EFS provides a shared file system with low latency and is accessible from multiple EC2 instances. Option A is wrong because EBS volumes can only be attached to one instance at a time (unless using Multi-Attach, which has limitations). Option B is wrong because S3 is object storage, not file storage. Option D is wrong because S3 Glacier is for archival.

Answer

Amazon S3

Answer

Amazon EBS with Provisioned IOPS

Answer

Amazon S3 Glacier

Question 7

A company is designing a new CI/CD pipeline for a web application that will be deployed on Amazon ECS. Which AWS service should the company use to build and test the application code?

Accepted Answer

AWS CodeBuild. Option B is correct because AWS CodeBuild is a fully managed build service. Option A is wrong because CodeCommit is a source control service. Option C is wrong because CodeDeploy is a deployment service. Option D is wrong because CodePipeline is a continuous delivery service.

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 8

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The company wants to ensure that traffic to the application is encrypted in transit. Which TWO actions should the company take?

Accepted Answer

Install an SSL/TLS certificate on the Application Load Balancer.. Options A and D are correct. The ALB handles SSL termination, and HTTPS listener ensures encryption. Option B is wrong because HTTP allows unencrypted traffic. Option C is wrong because CloudFront does not ensure encryption between ALB and EC2. Option E is wrong because an NLB does not support SSL termination natively.

Answer

Configure the Application Load Balancer with an HTTP listener that redirects to HTTPS.

Answer

Use a Network Load Balancer with TCP listener.

Answer

Place an Amazon CloudFront distribution in front of the ALB.

Question 9

A company is designing a new serverless application using AWS Lambda. The application must be invoked by an Amazon S3 bucket event. The company wants to ensure that the Lambda function has the necessary permissions to be invoked. Which THREE steps are required?

Accepted Answer

Add a resource-based policy to the Lambda function that grants S3 permission to invoke it.. Options A, B, and D are correct. A resource-based policy on the Lambda function allows S3 to invoke it. An S3 bucket notification configuration triggers the Lambda. IAM permissions on the S3 bucket are not required for invocation; the resource-based policy is. Option E is wrong because the event source mapping is not needed for S3.

Answer

Attach an IAM role to the S3 bucket that allows it to invoke Lambda functions.

Answer

Create an event source mapping in Lambda for the S3 bucket.

Question 10

A company is designing a new database solution for a global e-commerce application. The database must support high read and write throughput with single-digit millisecond latency. The company expects traffic spikes during peak hours. Which TWO AWS services should the company consider?

Accepted Answer

Amazon ElastiCache. Options A and C are correct. DynamoDB provides low-latency, high-throughput NoSQL database. ElastiCache provides in-memory caching for low latency. Option B is wrong because Aurora is relational and may not match DynamoDB's throughput for simple key-value access. Option D is wrong because DocumentDB is for document workloads. Option E is wrong because RDS is relational and less scalable.

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon Aurora

Answer

Amazon RDS for MySQL

Question 11

A company has an IAM policy attached to a user. The user is trying to download an object from the S3 bucket 'my-bucket' that was uploaded with SSE-S3 encryption. What will happen?

Accepted Answer

The user will be allowed to download the object.. Option A is correct because the condition requires s3:x-amz-server-side-encryption to be AES256, which matches SSE-S3. Option B is wrong because the condition is satisfied. Option C is wrong because SSE-S3 uses AES256. Option D is wrong because the condition is for get requests, not put.

Answer

The user will be allowed only if the object was uploaded with SSE-KMS.

Answer

The user will be denied access because the condition is not met.

Answer

The user will be denied because SSE-S3 is not AES256.

Question 12

A CloudFormation stack output is as above. The company wants to use the SQS queue URL in another stack. Which intrinsic function should be used to reference the queue URL in the second stack?

Accepted Answer

Fn::ImportValue. Option C is correct because Fn::ImportValue is used to import exported stack outputs. Option A is wrong because Fn::GetAtt gets attributes from resources in the same template. Option B is wrong because Fn::Ref returns a resource's primary identifier. Option D is wrong because Fn::Sub is for string substitution.

Answer

Fn::GetAtt

Answer

Fn::Sub

Answer

Fn::Ref

Question 13

An ALB is configured with a target group for HTTP:80. The health check returns a 302 redirect. What is the most likely cause of the unhealthy instances?

Accepted Answer

The application is redirecting health checks to another URL.. Option C is correct because a 302 redirect indicates the application is redirecting health checks, which is not expected. Option A is wrong because 302 is not a timeout. Option B is wrong because 302 is not a 4xx error. Option D is wrong because 302 is a redirect, not a 5xx.

Answer

The application is returning a 500 Internal Server Error.

Answer

The application is taking too long to respond.

Answer

The security group is blocking health check traffic.

Question 14

A company is designing a new microservices architecture using Amazon ECS with Fargate. Each service must be isolated within its own VPC and communicate via AWS PrivateLink. The company expects variable traffic and wants to minimize costs. Which solution meets these requirements?

Accepted Answer

Use separate VPCs per service and create VPC endpoint services for each.. Option D is correct because using VPC endpoints per service provides isolated connectivity without internet gateways or NAT gateways, reducing costs. Option A is wrong because a shared VPC compromises isolation. Option B is wrong because NAT gateways incur costs and are not needed for PrivateLink. Option C is wrong because Transit Gateway adds cost and complexity.

Answer

Use separate VPCs and connect them via VPC peering with NAT gateways.

Answer

Deploy all services in a single VPC with security groups to isolate traffic.

Answer

Use a single VPC with Transit Gateway to route between services.

Question 15

A financial services company is designing a solution to process real-time stock trade data. The data is ingested via Amazon Kinesis Data Streams with a shard count of 10. Each shard receives 500 records per second, each record is 1 KB. The company needs to archive all raw data to Amazon S3 within 5 minutes of receipt and also run a Lambda function to enrich each record. What is the most cost-effective and scalable approach?

Accepted Answer

Configure Kinesis Data Firehose to read from the stream and deliver to S3, and use a Lambda function for enrichment.. Option B is correct because Kinesis Data Firehose can read from the stream and buffer to S3 within minutes, while Lambda can process records in parallel. Option A is wrong because Lambda cannot directly write to S3 efficiently at this scale. Option C is wrong because KCL adds complexity and cost. Option D is wrong because Kinesis Analytics is for analytics, not archiving.

Answer

Use Kinesis Data Analytics to archive data to S3.

Answer

Use the Kinesis Client Library (KCL) to process records and write to S3.

Answer

Use a Lambda function to read from the stream and write to S3.