SAP-C02 Design for New Solutions Practice Test 11 — 15 Questions

Question 1

A company is designing a serverless data processing pipeline using AWS Lambda functions. The pipeline processes messages from an Amazon SQS queue. Each message takes approximately 30 seconds to process, and the pipeline must handle bursts of up to 10,000 messages per minute. The messages must be processed in the order they are received. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an SQS FIFO queue with a Lambda function configured with a reserved concurrency of 1000.. An SQS FIFO queue guarantees first-in-first-out delivery within each message group, and with multiple message group IDs, messages can be processed in parallel. The Lambda function can be configured with a batch size of up to 10 messages from the same group. Assuming that messages are distributed across many groups, each invocation processes a batch of messages in approximately 30 seconds, yielding a per-group throughput of up to 20 messages per minute. With a reserved concurrency of 1000, the pipeline can handle up to 1000 groups concurrently, achieving a total throughput of 20,000 messages per minute, which exceeds the required burst of 10,000 messages per minute. Reserved concurrency also ensures that the necessary capacity is available when needed, preventing throttling.

Answer

Use an SQS FIFO queue with a Lambda function that sets the Concurrency limit to 100.

Answer

Use an SQS Standard queue with a Lambda function that processes messages in batches.

Answer

Use an Amazon Kinesis Data Stream with a Lambda function that processes multiple records per invocation.

Question 2

A company is designing a new solution to store and analyze large volumes of IoT sensor data. The data is time-series and must be retained for 90 days. The company needs to run complex SQL queries on the data and expects low latency for the most recent 7 days of data. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Kinesis Data Analytics to analyze data in real-time and store results in S3.. Option A is correct because Amazon Kinesis Data Analytics can process streaming IoT data in real time using SQL, and storing the results in Amazon S3 provides durable, low-cost retention for the 90-day requirement while enabling later analysis. Option D is correct because Amazon Timestream is a purpose-built time-series database that supports SQL queries, automatic data tiering, and retention policies, so it can keep 90 days of data while serving the most recent 7 days from its in-memory store with low latency. Option B is not ideal because Amazon RDS for PostgreSQL with TimescaleDB requires managing relational infrastructure and does not natively provide the same serverless time-series tiering and retention model. Option C is not appropriate because Redshift is a data warehouse optimized for analytical queries, and snapshot retention is for backups, not for querying live time-series data with low latency. Option E is not suitable because DynamoDB with TTL and PartiQL is not designed for complex SQL analytics or low-latency time-series querying at this scale.

Answer

Use Amazon RDS for PostgreSQL with TimescaleDB extension.

Answer

Use Amazon Redshift with automated snapshot retention of 90 days.

Answer

Use Amazon DynamoDB with TTL to expire data after 90 days and use PartiQL for queries.

Question 3

A company is designing a hybrid cloud solution that extends its on-premises data center to AWS. The company has a 10 Gbps AWS Direct Connect connection and needs to securely connect multiple VPCs and on-premises networks with transitive routing. The solution must be highly available and use AWS managed services. Which TWO components should the company include in the design? (Choose TWO.)

Accepted Answer

AWS Transit Gateway with attachments for each VPC and the Direct Connect Gateway.. AWS Transit Gateway provides transitive routing between multiple VPCs and on-premises networks, eliminating the need for complex peering meshes. Option E is correct because attaching a Direct Connect Gateway to the Transit Gateway allows the single 10 Gbps Direct Connect connection to be shared across all attached VPCs, enabling centralized, highly available connectivity.

Answer

AWS Global Accelerator endpoints in each VPC.

Answer

AWS Site-to-Site VPN connections from on-premises to each VPC.

Answer

VPC peering between each VPC and the on-premises network.

Question 4

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to store files in Amazon S3. The company has a strict security requirement that the application must not have any long-term credentials stored in the container image or environment variables. Which THREE steps should the company take to meet this requirement? (Choose THREE.)

Accepted Answer

Create an IAM role with permissions to access the S3 bucket.. Option B is correct because creating an IAM role with the necessary S3 permissions establishes the identity that the application will assume, eliminating the need for static credentials. Option C is correct because attaching that IAM role to the ECS task definition as the task role allows the Fargate task's containers to obtain temporary, rotated credentials automatically via the ECS credential provider endpoint (AWS_CONTAINER_CREDENTIALS_RELATIVE_URI), so no long-term keys are stored in the image or environment variables. Option D is correct because the ECS task execution role must include iam:PassRole for the task role so that ECS can pass the task role to the Fargate task at launch; without this permission the task cannot start with the required role. Option A is not correct because storing AWS access keys in Secrets Manager still involves long-term credentials, which the requirement explicitly forbids. Option E is not correct because using environment variables for credentials is exactly the practice the company wants to avoid, and it relies on long-term keys rather than temporary role credentials.

Answer

Store AWS access keys in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure the application to use the AWS CLI with environment variables for credentials.

Question 5

A CloudFormation stack creation failed with the status shown in the exhibit. The stack was created using a template that defines an EC2 instance, a security group, and an Elastic IP address. What is the MOST likely cause of the failure?

Accepted Answer

The AWS account has reached the Elastic IP address limit.. The stack creation failed with a status that indicates a resource creation failure, and the most likely cause is that the AWS account has reached its Elastic IP address limit. Each AWS account has a default limit of 5 Elastic IP addresses per region, and attempting to create a new Elastic IP beyond this quota causes the CloudFormation stack to roll back. The error message in the exhibit (not shown here but implied) typically states 'The maximum number of addresses has been reached' or similar, confirming this as the root cause.

Answer

The security group rule is invalid.

Answer

The EC2 instance failed to associate with the Elastic IP.

Answer

The EC2 instance type is not supported in the region.

Question 6

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data lake will ingest data from multiple sources, including streaming data from Amazon Kinesis Data Streams and batch data from on-premises systems via AWS Snowball. The company needs to catalog the data and make it available for querying with Amazon Athena and Amazon Redshift Spectrum. Which combination of services should the company use to meet these requirements?

Accepted Answer

Use AWS Glue to create a data catalog and run ETL jobs for both streaming and batch data.. AWS Glue provides a fully managed data catalog that integrates with Amazon Athena and Amazon Redshift Spectrum, making it the central metadata repository for the data lake. It can run ETL jobs for both streaming data (via Glue Streaming ETL) and batch data (via Glue Crawlers and Jobs), satisfying the requirement to catalog and prepare data from Kinesis Data Streams and Snowball. This combination directly meets the need for a unified catalog and query readiness.

Answer

Use AWS Lake Formation to set up the data lake and use its built-in catalog.

Answer

Use Amazon Athena to create tables and partitions directly from S3.

Answer

Use Amazon Kinesis Data Firehose to deliver streaming data to S3 and catalog with Athena.

Question 7

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket. The company wants to use a custom domain name and SSL/TLS termination. Which THREE services should the company use together to meet these requirements? (Choose THREE.)

Accepted Answer

Amazon CloudFront with an S3 origin.. Amazon CloudFront with an S3 origin is correct because CloudFront is a global content delivery network (CDN) that caches static content at edge locations, providing low-latency access worldwide. It also supports custom domain names via alternate domain names (CNAMEs) and integrates with AWS Certificate Manager (ACM) for SSL/TLS termination, meeting all requirements for hosting a static website with global performance and security.

Answer

AWS WAF to protect the website.

Answer

Application Load Balancer to distribute traffic across multiple S3 buckets.

Question 8

A company is designing a disaster recovery solution for a critical application that runs on Amazon RDS for PostgreSQL. The application requires an RPO of 5 minutes and an RTO of 15 minutes. The primary database is in us-east-1. The recovery Region is us-west-2. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Configure a cross-Region read replica for the RDS PostgreSQL instance in us-west-2.. Option B is correct because a cross-Region read replica continuously replicates changes from the primary RDS for PostgreSQL instance in us-east-1 to us-west-2, giving an RPO well within 5 minutes, and it can be promoted to a standalone primary in us-west-2 in a short time, satisfying the 15-minute RTO. Option C is correct because Multi-AZ in us-east-1 provides a synchronous standby for high availability, while the cross-Region read replica in us-west-2 provides asynchronous replication for the disaster recovery Region; promoting that replica meets the 5-minute RPO and 15-minute RTO. Option A is not suitable because manual snapshots are periodic and cannot guarantee a 5-minute RPO, and restoring from a snapshot typically exceeds the 15-minute RTO. Option D is not applicable because Amazon Aurora Global Database is for Aurora, not standard Amazon RDS for PostgreSQL. Option E is not suitable because automated backups with cross-Region copy have a minimum RPO of the backup schedule and restore times that generally exceed the required 15-minute RTO.

Answer

Take manual snapshots periodically and copy them to us-west-2.

Answer

Use Amazon Aurora Global Database with a secondary cluster in us-west-2.

Answer

Use automated backups with cross-Region copy to us-west-2.

Question 9

A company is troubleshooting a Lambda function that is timing out when trying to connect to an RDS database in a VPC. The Lambda function configuration is shown in the exhibit. The function has a timeout of 30 seconds and a memory size of 128 MB. The VPC has subnets in multiple Availability Zones, but the function only has one subnet configured. What change will MOST LIKELY resolve the timeout?

Accepted Answer

Add subnets from other Availability Zones to the VPC configuration.. The Lambda function is timing out because it is configured with only one subnet, but the RDS database is in a VPC with subnets across multiple Availability Zones (AZs). Lambda requires at least one subnet per AZ used by the target resource to ensure network path availability; if the single subnet's AZ becomes unavailable or the RDS instance is in a different AZ, the connection fails. Adding subnets from other AZs provides redundant network paths, resolving the timeout.

Answer

Remove the VPC configuration to allow the function to access the internet.

Answer

Increase the function's memory size to 1024 MB.

Answer

Update the security group to allow all outbound traffic.

Question 10

A company is designing a serverless application using AWS Lambda to process incoming files from Amazon S3. Each file is less than 1 MB and processing must complete within 10 seconds. The application must handle bursts of up to 1,000 concurrent invocations. Which configuration will provide the MOST cost-effective solution?

Accepted Answer

Set function memory to 128 MB and leave concurrency at the account default of 1,000.. The default account-level concurrency limit is 1,000 concurrent executions, which meets the burst requirement without additional cost. With files under 1 MB and a 10-second timeout, 128 MB memory is sufficient for lightweight processing, and provisioned or reserved concurrency would incur unnecessary charges since the workload is sporadic and does not require pre-warmed instances.

Answer

Use provisioned concurrency for 1,000 concurrent executions with 128 MB memory.

Answer

Place the Lambda function in a VPC with 1,024 MB memory for faster processing.

Answer

Set reserved concurrency to 1,000 and function memory to 256 MB.

Question 11

A company is designing a multi-region disaster recovery solution for a stateful web application on Amazon EC2 with an Amazon Aurora MySQL database. The RPO must be less than 1 second and RTO less than 5 minutes. The application uses a custom TCP port 8080. What is the MOST cost-effective architecture?

Accepted Answer

Use Amazon Aurora Global Database. Use Amazon Route 53 failover routing with a health check on port 8080.. Amazon Aurora Global Database provides cross-region replication with a typical lag of under 1 second, meeting the RPO requirement, and supports failover in under 1 minute, satisfying the RTO of less than 5 minutes. Combined with Route 53 failover routing and a health check on port 8080, this architecture enables rapid, automated traffic redirection to the secondary region without additional compute or storage costs beyond the Aurora storage and I/O.

Answer

Use Amazon RDS Multi-AZ with synchronous replication. Use Elastic Load Balancing with cross-zone load balancing.

Answer

Use Amazon DynamoDB global tables. Use an Application Load Balancer in each region with Route 53 weighted routing.

Answer

Use Amazon RDS for MySQL with a cross-region read replica. Use Amazon Route 53 failover routing with a health check on port 8080.

Question 12

A company is building a microservices architecture on Amazon ECS with Fargate. Each service must be isolated and communicate only via APIs. The company needs to enforce that services cannot directly access each other's databases. Which approach should be used?

Accepted Answer

Create a separate VPC for each service and use VPC peering for API communication only.. Placing each microservice in its own VPC and using VPC peering for API communication only enforces strict network isolation at the VPC boundary. This prevents any direct database access between services, as the peering connection can be configured to allow only specific API ports (e.g., HTTPS 443) and not database ports (e.g., 3306, 5432). This design aligns with the principle of least privilege and ensures that services cannot bypass API gateways to reach each other's databases.

Answer

Use a single VPC with network ACLs to block database ports between services.

Answer

Use IAM policies to restrict database access at the API level.

Answer

Place all services in the same VPC and use security groups to restrict database access.

Question 13

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must maintain session state. The company expects steady traffic with occasional spikes. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Amazon ElastiCache for Redis provides a highly scalable, low-latency, and durable external session store that decouples session state from EC2 instances. This allows the Auto Scaling group to add or remove instances freely without losing session data, and Redis supports replication and persistence for reliability. Compared to DynamoDB, Redis offers lower latency for session access, and compared to Memcached, it provides data structures and persistence that are beneficial for session management.

Answer

Use sticky sessions (session affinity) on the ALB with a session cookie.

Answer

Use Amazon ElastiCache for Memcached to store session data.

Answer

Store session data in Amazon DynamoDB tables.

Question 14

A company needs to store application logs for at least one year with the ability to query them occasionally. The logs are generated at a rate of 10 GB per day. Which storage solution is MOST cost-effective?

Accepted Answer

Stream logs to Amazon S3 using Amazon Kinesis Data Firehose, then use S3 Lifecycle policies to transition to S3 Standard-IA after 30 days.. Amazon Kinesis Data Firehose can stream logs directly to Amazon S3, and S3 Lifecycle policies allow automatic transition to S3 Standard-IA after 30 days, which reduces storage costs for infrequently accessed data while still allowing occasional queries. This combination meets the one-year retention requirement cost-effectively, as S3 Standard-IA has lower storage costs than S3 Standard for data accessed less frequently, and the lifecycle transition avoids manual intervention.

Answer

Store logs on Amazon EBS volumes attached to a single EC2 instance for querying.

Answer

Store logs in Amazon S3 Glacier and use S3 Select to query directly.

Answer

Stream logs to Amazon CloudWatch Logs and set a retention policy of 365 days.

Question 15

A company is designing a hybrid cloud architecture that requires low-latency connectivity between on-premises and AWS. The company has multiple branch offices connecting to a central data center. The data center must be connected to AWS with 10 Gbps throughput and high availability. Which solution should the company choose?

Accepted Answer

Order two AWS Direct Connect connections from different providers and configure them in a LAG.. The requirement for 10 Gbps throughput and high availability mandates using two AWS Direct Connect connections from different providers, configured as a Link Aggregation Group (LAG). LAG aggregates multiple connections into a single logical interface, providing both increased bandwidth and redundancy. A single Direct Connect connection with a backup VPN (Option B) would not meet the 10 Gbps throughput requirement, as VPNs are typically limited to lower bandwidth and introduce latency. Option A and C rely on VPNs, which cannot guarantee 10 Gbps throughput and may suffer from internet-based variability.

Answer

Use AWS Transit Gateway to connect multiple VPCs to on-premises via a single VPN.

Answer

Use a single AWS Direct Connect connection with a backup VPN over the internet.

Answer

Set up multiple AWS Site-to-Site VPN connections from the data center to the VPC.