SAP-C02 Design for New Solutions Practice Test 11 — 15 Questions

Question 1

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

Accepted Answer

Amazon CloudFront for static content, Amazon API Gateway for the REST API, and AWS Lambda for compute.. Option A is correct because CloudFront serves static content with low latency, API Gateway provides a REST API endpoint, and Lambda integrates with DynamoDB. Option B is wrong because S3 Transfer Acceleration is for uploads, not global content delivery. Option C is wrong because ALB is not serverless. Option D is wrong because Lambda Edge runs at edge locations but is not needed for API backend.

Answer

Amazon CloudFront for static content, Application Load Balancer for API, and Lambda for compute.

Answer

AWS Lambda@Edge for both static content and API.

Answer

Amazon S3 for static content with Transfer Acceleration, and AWS Lambda for API.

Question 2

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Accepted Answer

Configure RDS Multi-AZ in the primary region.. Options A and C are correct. A Multi-AZ RDS instance with synchronous replication provides an RPO of seconds and can failover quickly. An Aurora Global Database with a secondary region also provides low RPO and RTO. Option B is wrong because cross-region snapshot restore takes longer than 15 minutes. Option D is wrong because RTO would be too high. Option E is wrong because RTO includes database failover.

Answer

Pre-warm a standby EC2 instance in the DR region.

Answer

Take hourly snapshots of RDS and copy them to the DR region.

Answer

Use Amazon S3 Cross-Region Replication for application data.

Question 3

A company is migrating a monolithic application to microservices on AWS. The current application uses a single Amazon RDS for PostgreSQL database. To avoid tight coupling, each microservice should have its own database. The company needs to minimize downtime during migration. Which THREE strategies should be used?

Accepted Answer

Design each microservice with its own database.. Options B, C, and D are correct. The Strangler Fig pattern gradually replaces functionality. Database per service ensures isolation. AWS DMS can migrate data with minimal downtime. Option A is wrong because a shared database defeats the purpose. Option E is wrong because a single large RDS instance is not a microservices pattern.

Answer

Use a single shared database with separate schemas for each service.

Answer

Deploy all microservices on a single large EC2 instance.

Question 4

A company wants to store configuration data for multiple applications securely. Each application runs on Amazon EC2 instances in an Auto Scaling group. The configuration includes database credentials and API keys. Which TWO services should be used together to achieve this?

Accepted Answer

IAM roles for EC2 instances.. Options A and B are correct. AWS Systems Manager Parameter Store securely stores configuration data, and IAM roles for EC2 provide secure access without hardcoding credentials. Option C is wrong because Secrets Manager is also a valid service but the question asks for two services. Option D is wrong because EC2 user data is not secure for credentials. Option E is wrong because S3 requires managing access keys.

Answer

AWS Secrets Manager.

Answer

Amazon S3 with bucket policies.

Answer

EC2 user data scripts.

Question 5

Refer to the exhibit. An IAM policy is attached to a user who needs to upload objects to an S3 bucket owned by another AWS account. The uploads are failing with access denied. What is the most likely cause?

Accepted Answer

The upload request does not include the required ACL header.. Option C is correct. The policy requires the x-amz-acl header to be set to 'bucket-owner-full-control', but the user's upload request likely does not include that header. Options A and B are wrong because the policy explicitly allows PutObject. Option D is wrong because the bucket policy is not shown.

Answer

The resource ARN is incorrect.

Answer

The bucket policy denies the request.

Answer

The user does not have s3:PutObject permission.

Question 6

Refer to the exhibit. A solutions architect runs this CLI command but receives an error: 'Unknown options: --query'. What is the most likely cause?

Accepted Answer

The --query parameter is used without specifying --output.. Option B is correct. The --query parameter is not supported by the ec2 describe-instances command in the default output format; it requires the --output json or --output table option to be specified first. Option A is wrong because the command syntax is correct. Option C is wrong because the filter is valid. Option D is wrong because the output table is specified.

Answer

The --filters parameter is incorrectly formatted.

Answer

The tag value is missing.

Answer

The AWS CLI version is outdated.

Question 7

Refer to the exhibit. A CloudFormation template creates an S3 bucket with versioning and a public bucket policy. After deployment, users can access objects in the bucket via the internet. However, the security team requires that all access be logged. What is missing from this configuration?

Accepted Answer

No logging configuration is specified.. Option D is correct. The template does not enable S3 server access logs or AWS CloudTrail for object-level logging. Option A is wrong because versioning is enabled. Option B is wrong because the policy is public. Option C is wrong because the bucket is not encrypted.

Answer

The bucket is not encrypted.

Answer

The bucket policy does not restrict access to a specific IP range.

Answer

Bucket versioning is not enabled.

Question 8

A company is designing a new application that processes sensitive healthcare data. The application runs on Amazon ECS with Fargate and uses an Application Load Balancer. The company must ensure that all data in transit is encrypted. Which step should be taken?

Accepted Answer

Configure the ALB listener to use HTTPS (port 443) with an SSL certificate.. Option A is correct. A listener on port 443 with an SSL certificate encrypts traffic between clients and the ALB. Option B is wrong because the security group does not encrypt traffic. Option C is wrong because HTTPS is needed at the ALB. Option D is wrong because the target group protocol should be HTTPS if encryption is required end-to-end, but the question asks for data in transit from clients.

Answer

Configure the target group to use HTTP protocol.

Answer

Configure the security group to only allow inbound traffic from approved IPs.

Answer

Use HTTP on port 80 and rely on VPC network ACLs.

Question 9

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

Accepted Answer

S3 Intelligent-Tiering. Option B is correct. S3 Intelligent-Tiering automatically moves data between frequent and infrequent access tiers based on usage, optimizing cost without compromising performance. Option A is wrong because S3 Standard is more expensive for infrequently accessed data. Option C is wrong because S3 Glacier has retrieval delays. Option D is wrong because S3 One Zone-IA has lower durability and availability.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 10

A company wants to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Option D is correct. Amazon EFS provides a shared file system that can be mounted by multiple EC2 instances. Option A is wrong because EBS volumes can only be attached to one instance at a time. Option B is wrong because S3 is object storage, not a file system. Option C is wrong because Instance Store is ephemeral.

Answer

EC2 Instance Store

Answer

Amazon S3

Answer

Amazon EBS

Question 11

A company is designing a new solution to ingest real-time clickstream data from a website. The data volume varies from 100 to 100,000 events per second. The solution must buffer the data for up to 5 minutes and then deliver it to Amazon S3 for analysis. The company wants to minimize operational overhead and cost. Which service should be used to buffer the data?

Accepted Answer

Amazon Kinesis Data Firehose. Option D is correct. Amazon Kinesis Data Firehose can buffer incoming data for up to 15 minutes and then deliver it to S3, with no server management. Option A is wrong because Kinesis Data Streams requires managing shards and consumers. Option B is wrong because SQS is not designed for large-scale streaming. Option C is wrong because Lambda has concurrency limits and is not a buffer.

Answer

Amazon Kinesis Data Streams

Answer

AWS Lambda

Answer

Amazon SQS

Question 12

A company is designing a new microservices architecture using AWS Lambda. Each microservice has its own database. The company wants to securely store database credentials and rotate them automatically. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option C is correct. AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because Parameter Store does not have built-in rotation. Option B is wrong because IAM is for access management, not secret storage. Option D is wrong because KMS is for encryption keys, not secrets.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM)

Question 13

A company is designing a multi-region active-active application using Amazon DynamoDB global tables. The application requires strong consistency reads. However, global tables only support eventual consistency. What should the solutions architect do to meet the requirement?

Accepted Answer

Design the application to handle eventual consistency using conditional writes and application logic.. Option A is correct. DynamoDB global tables use eventual consistency, but the application can use conditional writes and application-level conflict resolution to achieve strong consistency. Option B is wrong because DynamoDB Accelerator (DAX) is a cache, not a consistency mechanism. Option C is wrong because DynamoDB Streams is for change data capture. Option D is wrong because there is no configuration for strong consistency in global tables.

Answer

Enable strong consistency in the global table configuration.

Answer

Use DynamoDB Streams to replicate data to another region with strong consistency.

Answer

Use DynamoDB Accelerator (DAX) to provide strong consistency reads.

Question 14

A company is designing a new serverless application using AWS Lambda to process high-resolution images uploaded to Amazon S3. Each image can be up to 500 MB. The processing must complete within 5 minutes. What is the MOST cost-effective and scalable design to meet these requirements?

Accepted Answer

Configure S3 event notifications to invoke a Lambda function that processes the image in memory and writes the result to another S3 bucket.. Option A is correct because Lambda can directly process images up to 500 MB with a maximum execution time of 15 minutes, and S3 event notifications trigger Lambda directly. Option B is wrong because Fargate adds complexity and cost for simple processing. Option C is wrong because SQS adds latency and cost without benefit. Option D is wrong because Step Functions adds orchestration overhead.

Answer

Use S3 event notifications to send the image to an Amazon SQS queue, then process it with a Lambda function.

Answer

Use AWS Fargate to run a containerized image processing service triggered by S3 event notifications.

Answer

Use AWS Step Functions to orchestrate a Lambda function and an EC2 instance for processing.

Question 15

A financial services company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets in any account have server-side encryption enabled using AWS KMS (SSE-KMS) with a customer managed key. Additionally, they want to prevent any S3 bucket from being publicly accessible. What is the MOST efficient and comprehensive way to enforce these policies?

Accepted Answer

Create an SCP that denies s3:PutObject without the x-amz-server-side-encryption-aws:kms header, and another SCP that denies s3:PutBucketPublicAccessBlock with a condition key. Also, use a resource-based policy on the S3 service to block public access.. Option C is correct because SCPs and resource-based policies can be combined to enforce encryption and prevent public access across all accounts. Option A is wrong because SCPs cannot enforce encryption on resources directly; they only control permissions. Option B is wrong because Config rules require remediation steps and are not preventive. Option D is wrong because it misses public access prevention.

Answer

Use a service control policy (SCP) to deny the s3:PutBucketAcl action that grants public access, and rely on bucket policies to enforce encryption.

Answer

Use AWS Config rules with automatic remediation to enable encryption and block public access on any non-compliant bucket.

Answer

Create an SCP that denies the s3:PutBucketPublicAccessBlock action and attach it to the root OU.