SAP-C02 Design for New Solutions Practice Test 12 — 15 Questions

Question 1

A company is designing a new serverless application using AWS Lambda. The application must be invoked by an Amazon S3 bucket event. The company wants to ensure that the Lambda function has the necessary permissions to be invoked. Which THREE steps are required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a resource-based policy to the Lambda function that grants S3 permission to invoke it.. Lambda uses a resource-based policy (also known as a function policy) to grant other AWS services, such as S3, permission to invoke the function. Without this policy, S3 does not have the necessary invoke permissions, and the Lambda function will reject the invocation request.

Answer

Attach an IAM role to the S3 bucket that allows it to invoke Lambda functions.

Answer

Create an event source mapping in Lambda for the S3 bucket.

Question 2

A company is designing a new database solution for a global e-commerce application. The database must support high read and write throughput with single-digit millisecond latency. The company expects traffic spikes during peak hours. Which TWO AWS services should the company consider?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache provides an in-memory caching layer (e.g., Redis or Memcached) that can absorb read-heavy traffic spikes with sub-millisecond latency, offloading reads from the primary database. Amazon DynamoDB is a fully managed NoSQL database that delivers consistent single-digit millisecond latency at any scale, supports auto-scaling for traffic spikes, and handles high write throughput via its distributed architecture.

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon Aurora

Answer

Amazon RDS for MySQL

Question 3

A company has an IAM policy attached to a user. The user is trying to download an object from the S3 bucket 'my-bucket' that was uploaded with SSE-S3 encryption. What will happen?

Accepted Answer

The user will be allowed to download the object.. SSE-S3 uses AES-256 encryption managed by Amazon S3, and the encryption/decryption process is transparent to the user. When a user has the s3:GetObject permission in their IAM policy, they can download the object regardless of SSE-S3 encryption, as S3 automatically decrypts the object upon retrieval. The IAM policy does not require any additional conditions for SSE-S3, so the user is allowed to download the object.

Answer

The user will be allowed only if the object was uploaded with SSE-KMS.

Answer

The user will be denied access because the condition is not met.

Answer

The user will be denied because SSE-S3 is not AES256.

Question 4

A CloudFormation stack output is as above. The company wants to use the SQS queue URL in another stack. Which intrinsic function should be used to reference the queue URL in the second stack?

Accepted Answer

Fn::ImportValue. A is correct because Fn::ImportValue is the only intrinsic function that can reference a cross-stack output value exported via the Export field in a CloudFormation stack. Since the SQS queue URL is an output from one stack and needs to be used in another stack, Fn::ImportValue is required to import the exported value by name.

Answer

Fn::GetAtt

Answer

Fn::Sub

Answer

Fn::Ref

Question 5

An ALB is configured with a target group for HTTP:80. The health check returns a 302 redirect. What is the most likely cause of the unhealthy instances?

Accepted Answer

The application is redirecting health checks to another URL.. The ALB health check expects a 200 OK response from the target. A 302 redirect indicates the application is responding with a redirect (e.g., HTTP to HTTPS or to a login page) instead of a success status. This causes the health check to fail because the ALB does not follow redirects for health checks; it only accepts the configured success codes (default 200).

Answer

The application is returning a 500 Internal Server Error.

Answer

The application is taking too long to respond.

Answer

The security group is blocking health check traffic.

Question 6

A company is designing a new microservices architecture using Amazon ECS with Fargate. Each service must be isolated within its own VPC and communicate via AWS PrivateLink. The company expects variable traffic and wants to minimize costs. Which solution meets these requirements?

Accepted Answer

Use separate VPCs per service and create VPC endpoint services for each.. AWS PrivateLink allows services in separate VPCs to communicate privately without exposing traffic to the public internet. By creating a VPC endpoint service in each service's VPC and configuring Network Load Balancers, each microservice remains isolated in its own VPC, meeting the isolation requirement while minimizing costs by avoiding NAT gateways or Transit Gateway attachments.

Answer

Use separate VPCs and connect them via VPC peering with NAT gateways.

Answer

Deploy all services in a single VPC with security groups to isolate traffic.

Answer

Use a single VPC with Transit Gateway to route between services.

Question 7

A financial services company is designing a solution to process real-time stock trade data. The data is ingested via Amazon Kinesis Data Streams with a shard count of 10. Each shard receives 500 records per second, each record is 1 KB. The company needs to archive all raw data to Amazon S3 within 5 minutes of receipt and also run a Lambda function to enrich each record. What is the most cost-effective and scalable approach?

Accepted Answer

Configure Kinesis Data Firehose to read from the stream and deliver to S3, and use a Lambda function for enrichment.. Kinesis Data Firehose can directly subscribe to a Kinesis Data Stream as its source, automatically reading all records from the stream and delivering them to S3 with a configurable buffer interval (e.g., 60 seconds), easily meeting the 5-minute requirement. For enrichment, Firehose can invoke a Lambda function on each incoming record before delivery, making this a fully managed, serverless pipeline that scales without manual shard management or custom code.

Answer

Use Kinesis Data Analytics to archive data to S3.

Answer

Use the Kinesis Client Library (KCL) to process records and write to S3.

Answer

Use a Lambda function to read from the stream and write to S3.

Question 8

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

Accepted Answer

Amazon CloudFront for static content, Amazon API Gateway for the REST API, and AWS Lambda for compute.. It combines Amazon CloudFront for global low-latency delivery of static content, Amazon API Gateway to create and manage the REST API with built-in caching and throttling, and AWS Lambda for serverless compute. This architecture provides high availability, automatic scaling, and global edge caching, meeting the startup's requirements without managing servers.

Answer

Amazon CloudFront for static content, Application Load Balancer for API, and Lambda for compute.

Answer

AWS Lambda@Edge for both static content and API.

Answer

Amazon S3 for static content with Transfer Acceleration, and AWS Lambda for API.

Question 9

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Accepted Answer

Configure RDS Multi-AZ in the primary region.. RDS Multi-AZ provides automatic failover to a standby in a different Availability Zone within the same region, achieving an RTO typically under 1-2 minutes and an RPO of zero (synchronous replication). This meets the 15-minute RTO and 1-minute RPO for intra-region failures, but it does not address cross-region DR. Option B is correct because Amazon Aurora Global Database uses asynchronous replication with a typical RPO of 1 second or less and can promote a secondary region in under 1 minute, satisfying both the 15-minute RTO and 1-minute RPO for a full regional disaster.

Answer

Pre-warm a standby EC2 instance in the DR region.

Answer

Take hourly snapshots of RDS and copy them to the DR region.

Answer

Use Amazon S3 Cross-Region Replication for application data.

Question 10

A company is migrating a monolithic application to microservices on AWS. The current application uses a single Amazon RDS for PostgreSQL database. To avoid tight coupling, each microservice should have its own database. The company needs to minimize downtime during migration. Which THREE strategies should be used?

Accepted Answer

Design each microservice with its own database.. Designing each microservice with its own database enforces the database-per-service pattern, which is essential for loose coupling and independent deployability. This approach prevents tight coupling at the data layer, allowing each microservice to choose the most appropriate database technology and schema without impacting other services. It directly supports the migration goal of breaking the monolithic application into autonomous components.

Answer

Use a single shared database with separate schemas for each service.

Answer

Deploy all microservices on a single large EC2 instance.

Question 11

A company wants to store configuration data for multiple applications securely. Each application runs on Amazon EC2 instances in an Auto Scaling group. The configuration includes database credentials and API keys. Which TWO services should be used together to achieve this?

Accepted Answer

IAM roles for EC2 instances.. And E. IAM roles for EC2 instances (C) allow EC2 to securely access other AWS services without hardcoding credentials. AWS Systems Manager Parameter Store (E) provides secure, hierarchical storage for configuration data and secrets. Together, they enable EC2 to retrieve configuration data like database credentials and API keys at runtime without embedding secrets in code or user data. Option A (Secrets Manager) is also valid for secrets, but the question asks for two services, and the marked correct pair is C and E. Option B (S3 with bucket policies) is insecure for secrets, and option D (EC2 user data) is not secure for credentials.

Answer

AWS Secrets Manager.

Answer

Amazon S3 with bucket policies.

Answer

EC2 user data scripts.

Question 12

Refer to the exhibit. An IAM policy is attached to a user who needs to upload objects to an S3 bucket owned by another AWS account. The uploads are failing with access denied. What is the most likely cause?

Accepted Answer

The upload request does not include the required ACL header.. When an IAM user in Account A uploads objects to an S3 bucket in Account B, the bucket policy must explicitly grant the cross-account principal `s3:PutObject` permission. However, if the bucket is configured to require the `bucket-owner-full-control` canned ACL (or a specific ACL header) for uploaded objects, the request must include that ACL header. Without it, S3 denies the upload even if the IAM policy and bucket policy otherwise allow the action. This is a common requirement when the bucket owner wants to ensure they retain full control of objects uploaded by other accounts.

Answer

The resource ARN is incorrect.

Answer

The bucket policy denies the request.

Answer

The user does not have s3:PutObject permission.

Question 13

Refer to the exhibit. A solutions architect runs this CLI command but receives an error: 'Unknown options: --query'. What is the most likely cause?

Accepted Answer

The AWS CLI version is outdated.. The 'Unknown options: --query' error occurs when the AWS CLI version is outdated and does not recognize the --query parameter. The --query parameter was introduced in AWS CLI version 1.6.0. If the CLI version is older, it will treat --query as an unknown option. While it is true that --query often requires --output for proper formatting, the error for missing --output would be different, not 'Unknown options'. Therefore, the most likely cause is an outdated AWS CLI version.

Answer

The --filters parameter is incorrectly formatted.

Answer

The --query parameter is used without specifying --output.

Answer

The tag value is missing.

Question 14

Refer to the exhibit. A CloudFormation template creates an S3 bucket with versioning and a public bucket policy. After deployment, users can access objects in the bucket via the internet. However, the security team requires that all access be logged. What is missing from this configuration?

Accepted Answer

No logging configuration is specified.. The question states that the security team requires all access to be logged, but the CloudFormation template does not include any logging configuration (e.g., server access logs or AWS CloudTrail object-level logging). Without enabling S3 server access logging or delivering logs to a target bucket, no access records are generated, violating the logging requirement. The bucket policy and versioning are irrelevant to the logging gap.

Answer

The bucket is not encrypted.

Answer

The bucket policy does not restrict access to a specific IP range.

Answer

Bucket versioning is not enabled.

Question 15

A company is designing a new application that processes sensitive healthcare data. The application runs on Amazon ECS with Fargate and uses an Application Load Balancer. The company must ensure that all data in transit is encrypted. Which step should be taken?

Accepted Answer

Configure the ALB listener to use HTTPS (port 443) with an SSL certificate.. To encrypt data in transit between clients and the Application Load Balancer (ALB), you must configure the ALB listener to use HTTPS (port 443) with an SSL/TLS certificate. This ensures that all traffic between the client and the load balancer is encrypted using TLS, meeting the requirement for encrypted data in transit for sensitive healthcare data.

Answer

Configure the target group to use HTTP protocol.

Answer

Configure the security group to only allow inbound traffic from approved IPs.

Answer

Use HTTP on port 80 and rely on VPC network ACLs.