SAP-C02 Design for New Solutions Practice Test 11 — 15 Questions

Question 1

A company is designing a new real-time analytics platform that processes streaming data from IoT devices. The data must be ingested, processed with windowed aggregations, and stored in Amazon S3 for long-term analytics. The solution must handle late-arriving data and provide exactly-once processing semantics. Which combination of AWS services should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon Kinesis Data Analytics for Apache Flink to process data from Kinesis Data Streams and output to S3.. Amazon Kinesis Data Analytics for Apache Flink provides built-in support for windowed aggregations, exactly-once processing semantics, and handling late-arriving data via allowed lateness and watermarking. It can output processed results directly to Amazon S3 using a Flink sink, meeting all requirements for a real-time analytics platform.

Answer

Use Amazon Kinesis Data Firehose to ingest data and AWS Glue for processing.

Answer

Use Amazon EMR with Spark Streaming to process data from Kinesis Data Streams.

Answer

Use AWS Lambda to process records from Kinesis Data Streams and store in S3.

Question 2

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

Accepted Answer

Configure the ALB as internet-facing and attach it to multiple Availability Zones.. An internet-facing Application Load Balancer (ALB) must be attached to multiple Availability Zones (AZs) to provide high availability and fault tolerance. If the ALB is configured in only one AZ, a failure in that AZ would render the application unreachable. Option C is correct because EC2 instances must be launched in at least two AZs to serve as healthy targets for the ALB, ensuring that traffic can be routed to instances in another AZ if one AZ fails.

Answer

Launch all EC2 instances in a single Availability Zone.

Answer

Use a Network Load Balancer instead of an Application Load Balancer.

Answer

Assign Elastic IP addresses to each EC2 instance.

Question 3

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Accepted Answer

EC2 Spot Instances to reduce compute costs.. A is correct because EC2 Spot Instances can reduce compute costs by up to 90% compared to On-Demand instances, making them ideal for fault-tolerant, stateless batch workloads that can handle interruptions. The batch processing system described is CPU-intensive and runs for up to 2 hours per file, which fits well within the typical Spot interruption notice (2 minutes) and can be retried using AWS Batch’s built-in retry logic.

Answer

AWS Lambda functions to process each file.

Answer

Auto Scaling group with scheduled scaling policies.

Question 4

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 with an Amazon RDS for MySQL database. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Aurora Global Database for the database tier.. Amazon Aurora Global Database supports cross-region replication with typical RPO of less than 1 second and RTO of less than 1 minute, easily meeting the 15-minute RTO and 1-hour RPO. The primary region writes are asynchronously replicated to up to five secondary regions, and in a disaster, you can promote a secondary region to full read/write in under a minute.

Answer

Use EC2 AMI copy to another region and launch instances from the AMI.

Answer

Use RDS cross-region snapshots and restore in the DR region.

Answer

Configure RDS Multi-AZ in the primary region.

Question 5

A solutions architect runs the above CLI command. What is the output format?

Accepted Answer

A JSON array of strings.. The CLI command shown is `aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId'`. The `--query` parameter uses JMESPath to extract a list of instance IDs, which results in a JSON array of strings (e.g., `["i-123", "i-456"]`). AWS CLI output defaults to JSON unless `--output` is specified, and the JMESPath expression here returns an array, not a single object or table.

Answer

YAML formatted output.

Answer

A text table with columns.

Answer

A JSON object with keys.

Question 6

An IAM policy is attached to an IAM user. The user tries to download an object from S3 bucket 'example-bucket' from an IP address 10.0.1.5. What will happen?

Accepted Answer

The request is allowed.. The IAM policy is attached to the IAM user and includes a condition that denies access unless the request originates from a specific IP address range (e.g., 10.0.0.0/16). Since the request comes from IP 10.0.1.5, which falls within that allowed range, the condition is satisfied, and the policy's effect is to allow the s3:GetObject action. Therefore, the download is permitted.

Answer

The policy has no effect because the condition is invalid.

Answer

The request is denied unless there is another explicit deny.

Answer

The request is denied.

Question 7

A solutions architect attempts to create this stack but receives an error: "Value of property SecurityGroups must be a list of strings". What is the likely cause?

Accepted Answer

The SecurityGroups property should be a list, but the YAML specifies a single reference incorrectly.. The error 'Value of property SecurityGroups must be a list of strings' occurs because the YAML template specifies the SecurityGroups property as a single string (e.g., !Ref MySecurityGroup) instead of a list of strings (e.g., [!Ref MySecurityGroup]). In AWS CloudFormation, the SecurityGroups property for an EC2 instance expects a list of security group IDs or names, even if only one security group is provided. The YAML syntax must wrap the reference in square brackets to form a list, or the template will fail validation.

Answer

The security group ingress rule allows SSH from anywhere.

Answer

There is a circular dependency between the EC2 instance and the security group.

Answer

The AMI ID is invalid.

Question 8

A company is designing a new serverless application on AWS. The application consists of multiple AWS Lambda functions that process incoming events from an Amazon SQS queue. The company wants to ensure that each message is processed exactly once. Which configuration should the company use?

Accepted Answer

Use an SQS FIFO queue and enable content-based deduplication.. An SQS FIFO queue guarantees first-in, first-out delivery and exactly-once processing, eliminating duplicates within a message group. Enabling content-based deduplication allows the queue to automatically detect and discard duplicate messages based on the message body, ensuring each Lambda invocation processes a unique message without additional application logic.

Answer

Use a standard SQS queue and set the Lambda function reserved concurrency to 1.

Answer

Use a standard SQS queue and configure Lambda destinations for the queue.

Answer

Use an SQS FIFO queue and configure DynamoDB Streams as the event source for Lambda.

Question 9

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. The application must scale based on the number of requests per container. The company wants to use a service that can automatically adjust the number of tasks based on a custom metric. Which solution should the company use?

Accepted Answer

Configure an ECS Service Auto Scaling policy with a target tracking scaling policy based on a custom CloudWatch metric.. ECS Service Auto Scaling with a target tracking scaling policy can use a custom CloudWatch metric (e.g., requests per container) to automatically adjust the number of Fargate tasks. This approach directly matches the requirement to scale based on a custom metric, as target tracking maintains the metric at a specified target value by adding or removing tasks.

Answer

Configure Amazon DynamoDB auto scaling to adjust the read capacity based on the request count.

Answer

Use Application Auto Scaling to register the ECS service and create a step scaling policy.

Answer

Use the AWS Auto Scaling console to create a scaling plan that includes the ECS service.

Question 10

A company is designing a new microservices architecture on AWS. The company wants to use a service mesh to manage service-to-service communication, observability, and security. Which AWS service should the company use?

Accepted Answer

AWS App Mesh. AWS App Mesh is a service mesh that provides application-level networking to manage service-to-service communication, observability (via metrics, logs, and traces), and security (via mTLS and fine-grained access policies) for microservices. It uses the Envoy proxy as a sidecar to intercept traffic, enabling features like traffic splitting, retries, and circuit breaking without modifying application code.

Answer

Amazon API Gateway

Answer

AWS Transit Gateway

Answer

AWS Cloud Map

Question 11

A company is designing a new application that will run on Amazon EKS. The development team wants to deploy containers in a way that minimizes operational overhead. Which compute option should the company choose?

Accepted Answer

AWS Fargate. AWS Fargate is the correct compute option because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. By using Fargate with Amazon EKS, the development team can deploy containers without worrying about node scaling, patching, or cluster capacity, thereby minimizing operational overhead.

Answer

Amazon EKS managed node groups

Answer

Amazon EC2 instances

Answer

Self-managed EC2 nodes

Question 12

A company is designing a new serverless data processing pipeline. The pipeline uses AWS Lambda to process records from an Amazon Kinesis Data Stream. The company wants to ensure that failed records are automatically retried and sent to a dead-letter queue after three failed attempts. Which configuration should the company use?

Accepted Answer

Configure an on-failure destination on the Kinesis event source mapping to send records to an SQS queue.. The on-failure destination on a Kinesis event source mapping allows you to specify an SQS queue to which records are sent after a configurable number of retry attempts (default is 3). This is the native mechanism for handling failed records in a Lambda-Kinesis integration, providing automatic retries and dead-letter queue behavior without custom code.

Answer

Configure the Kinesis stream to send failed records to an SQS standard queue.

Answer

Configure the Lambda function's dead-letter queue property with an SQS queue.

Answer

Configure a Lambda destination on the function to send events to an SQS queue.

Question 13

A company is designing a new application that requires low-latency access to a shared dataset across multiple EC2 instances in the same AWS Region. The dataset is updated frequently. Which storage solution should the company use?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones within the same AWS Region. It offers low-latency access and supports frequent updates through its standard storage class, making it ideal for shared datasets that require consistent, low-latency performance.

Answer

Amazon S3

Answer

Amazon EBS with Provisioned IOPS

Answer

Amazon S3 Glacier

Question 14

A company is designing a new CI/CD pipeline for a web application that will be deployed on Amazon ECS. Which AWS service should the company use to build and test the application code?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. For a CI/CD pipeline that requires building and testing application code before deployment to Amazon ECS, CodeBuild is the correct service to perform these build and test actions.

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 15

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The company wants to ensure that traffic to the application is encrypted in transit. Which TWO actions should the company take?

Accepted Answer

Install an SSL/TLS certificate on the Application Load Balancer.. Installing an SSL/TLS certificate on the Application Load Balancer (ALB) is required to terminate HTTPS connections and enable encryption of traffic between clients and the ALB. Option E is correct because configuring the ALB with an HTTPS listener is necessary to accept encrypted traffic on port 443 and use the installed certificate for decryption. Together, these actions ensure that traffic to the application is encrypted in transit from the client to the load balancer.

Answer

Configure the Application Load Balancer with an HTTP listener that redirects to HTTPS.

Answer

Use a Network Load Balancer with TCP listener.

Answer

Place an Amazon CloudFront distribution in front of the ALB.