SAP-C02 Design for New Solutions Practice Test 12 — 15 Questions

Question 1

A startup is building a web application on AWS that requires a relational database. They expect unpredictable traffic patterns and want to minimize costs while ensuring high availability. Which database solution should they choose?

Accepted Answer

Amazon Aurora Serverless (MySQL-compatible). Option B is correct because Aurora Serverless automatically scales based on demand and provides high availability with multi-AZ storage. Option A is wrong because DynamoDB is NoSQL, not relational. Option C is wrong because RDS Single-AZ lacks high availability. Option D is wrong because Redshift is for data warehousing, not transactional workloads.

Answer

Amazon Redshift with concurrency scaling

Answer

Amazon RDS for MySQL with Single-AZ deployment

Answer

Amazon DynamoDB with on-demand capacity

Question 2

A media company is designing a video transcoding pipeline. They receive raw video files in Amazon S3, which need to be transcoded into multiple formats. The pipeline must handle sporadic bursts of uploads and complete processing within 30 minutes for each video. The cost should be minimized. Which design should they use?

Accepted Answer

Use Amazon S3 event notifications to trigger an AWS Elemental MediaConvert job.. Option A is correct because AWS Elemental MediaConvert is a serverless transcoding service that scales automatically and is cost-effective for sporadic workloads. Option B is wrong because EC2 Auto Scaling requires management and incurs costs even when idle. Option C is wrong because Elastic Transcoder is being deprecated and has less features. Option D is wrong because Lambda has a 15-minute timeout and is not suitable for transcoding.

Answer

Use AWS Lambda with layers containing FFmpeg to transcode videos.

Answer

Provision a cluster of EC2 instances running FFmpeg, with Auto Scaling based on SQS queue depth.

Answer

Use Amazon Elastic Transcoder, which is fully managed and triggers from S3 events.

Question 3

A company is designing a disaster recovery (DR) solution for a critical application running on Amazon EC2 instances in a single AWS Region. The DR site will be in a different Region. The application data is stored in an Amazon RDS for MySQL DB instance with Multi-AZ enabled. The Recovery Point Objective (RPO) is 15 minutes, and the Recovery Time Objective (RTO) is 2 hours. Which strategy meets these requirements MOST cost-effectively?

Accepted Answer

Configure a cross-Region read replica for the RDS MySQL DB instance. In the DR event, promote the read replica to a standalone instance.. Option C is correct because a read replica in another Region provides an RPO of seconds and an RTO of minutes when promoted, and it is low cost. Option A is wrong because cross-Region snapshots have longer RPO (daily) and RTO (hours). Option B is wrong because Aurora Global Database is more expensive and not MySQL-compatible. Option D is wrong because EC2 Image Builder does not address database replication.

Answer

Take daily automated snapshots of the RDS DB instance and copy them to the DR Region. In the DR Region, restore the DB instance from the latest snapshot.

Answer

Use Amazon Aurora Global Database to replicate data across Regions.

Answer

Use AWS Backup to copy backups to the DR Region and set up EC2 Image Builder for application recovery.

Question 4

A company is designing a microservices architecture on Amazon ECS with Fargate. They want to ensure that services can communicate with each other but are isolated from the internet. What is the MOST secure way to achieve this?

Accepted Answer

Place all ECS services in private subnets and use AWS Cloud Map for service discovery.. Option A is correct because placing services in private subnets and using ECS service discovery with AWS Cloud Map allows internal DNS resolution without internet exposure. Option B is wrong because AWS PrivateLink is used for accessing services over endpoints, not service-to-service. Option C is wrong because VPC peering is for connecting VPCs, not for service discovery. Option D is wrong because placing in public subnets exposes services to the internet.

Answer

Use VPC peering to connect the subnets of each service.

Answer

Use AWS PrivateLink to create VPC endpoints for each service.

Answer

Place services in public subnets and use security groups to restrict inbound traffic.

Question 5

A company is designing a data lake on Amazon S3. Data is ingested from various sources, including IoT devices, and must be stored in a cost-effective manner. The data access patterns are unpredictable; some data is accessed frequently for a few days, then rarely accessed. The company wants to minimize storage costs while ensuring data is available within minutes when accessed. Which storage class should they use for the data?

Accepted Answer

S3 Intelligent-Tiering. Option D is correct because S3 Intelligent-Tiering automatically moves data between frequent and infrequent access tiers based on usage patterns, with no retrieval charges for infrequent access, and data is available within milliseconds. Option A is wrong because S3 Standard is expensive for rarely accessed data. Option B is wrong because S3 Glacier Deep Archive has retrieval times of 12 hours. Option C is wrong because S3 One Zone-IA is not durable enough for a data lake.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-Infrequent Access

Question 6

A company is designing a new application on AWS that uses Amazon API Gateway and AWS Lambda to expose a RESTful API. The API must authenticate requests using OAuth 2.0 with an external identity provider (IdP). The company wants to offload the authentication logic to the API Gateway. Which API Gateway feature should they use?

Accepted Answer

Configure a Lambda authorizer to validate the OAuth 2.0 token.. Option A is correct because API Gateway supports OAuth 2.0 authorization using Cognito User Pools or custom authorizers with Lambda. Option B is wrong because WebSocket API is for real-time communication. Option C is wrong because VPC Link is for private integrations. Option D is wrong because usage plans are for API keys, not authentication.

Answer

Use API Gateway's WebSocket API.

Answer

Enable API Gateway's VPC Link.

Answer

Use usage plans with API keys.

Question 7

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions. What should they do?

Accepted Answer

Enable sticky sessions on the ALB using duration-based cookies.. Option B is correct because ALB supports sticky sessions using cookies. Option A is wrong because NLB does not support sticky sessions natively. Option C is wrong because CloudFront does not handle session stickiness. Option D is wrong because ElastiCache is for caching, not session stickiness at the load balancer level.

Answer

Configure an Amazon CloudFront distribution with session affinity.

Answer

Store session data in Amazon ElastiCache and use a cookie to reference it.

Answer

Use a Network Load Balancer (NLB) with cross-zone load balancing.

Question 8

A company is designing a new serverless data processing pipeline that uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be processed using AWS Lambda and then stored in Amazon S3. The company needs to ensure that records are processed in order within each shard and that each record is processed exactly once. Which configuration should they use? (Choose TWO.)

Accepted Answer

Use the Kinesis Client Library (KCL) and implement deduplication logic in the Lambda function.. Options A and C are correct. To guarantee ordering within a shard, use a single Lambda consumer per shard (option A). Exactly-once processing can be achieved by using the Kinesis Client Library (KCL) with an at-least-once delivery and deduplication in the Lambda function (option C). Option B is wrong because increasing batch size reduces ordering guarantees. Option D is wrong because SQS FIFO is for decoupling with ordering but introduces complexity. Option E is wrong because parallelization is not needed for ordering.

Answer

Use an Amazon SQS FIFO queue between Kinesis and Lambda to ensure ordering.

Answer

Increase the batch window to reduce the number of Lambda invocations.

Answer

Enable parallelization factor on the Lambda event source mapping.

Question 9

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Accepted Answer

Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.. Options A, B, and D are correct. Placing web tier instances in a private subnet (A) ensures they are not internet-facing. Using a security group for the database that allows inbound traffic only from the web tier security group (B) restricts access. Enabling the 'publicly accessible' flag to 'No' (D) ensures no public endpoint. Option C is wrong because placing the database in a public subnet would expose it. Option E is wrong because storing secrets in Parameter Store is for credentials, not network access.

Answer

Launch the database instance in a public subnet.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Question 10

A company is designing a new static website hosted on Amazon S3. They want to use Amazon CloudFront as a content delivery network (CDN) to serve the website globally with low latency. The website content must be encrypted in transit. Which configurations should they use? (Choose TWO.)

Accepted Answer

Configure the S3 bucket policy to deny requests that do not use HTTPS.. Options A and C are correct. Configuring CloudFront to require HTTPS (A) ensures encryption in transit between viewers and CloudFront. Configuring S3 bucket to only allow HTTPS (C) ensures encryption between CloudFront and S3. Option B is wrong because S3 Transfer Acceleration is for speed, not encryption. Option D is wrong because S3 default encryption is for at-rest, not in transit. Option E is wrong because CloudFront signed URLs are for access control, not encryption.

Answer

Enable default encryption on the S3 bucket using AES-256.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use CloudFront signed URLs to restrict access.

Question 11

A company has an IAM policy attached to a user as shown in the exhibit. The user is trying to stop an EC2 instance in the us-west-2 region. What will happen?

Accepted Answer

The user cannot stop the instance because the second statement denies all actions in regions other than us-east-1.. Option C is correct. The first statement allows DescribeInstances, StartInstances, StopInstances. The second statement denies all actions if the requested region is not us-east-1. Since us-west-2 is not us-east-1, the deny applies, and the user cannot stop the instance. Option A is wrong because the deny overrides the allow. Option B is wrong because the user cannot stop the instance. Option D is wrong because the action is explicitly denied.

Answer

The user cannot stop the instance because the condition checks the request region.

Answer

The user can stop the instance because the first statement allows it.

Answer

The user can stop the instance because the condition applies only to the Deny statement, but the Allow statement is unconditional.

Question 12

A solutions architect is troubleshooting an issue where an EC2 instance cannot connect to the internet. The output of the describe-instances CLI command is shown in the exhibit. The instance is in a VPC with a public subnet that has a route table with a default route pointing to an internet gateway. The security group allows outbound traffic to 0.0.0.0/0. What is the MOST likely cause of the problem?

Accepted Answer

The subnet's route table does not have a route to the internet gateway.. Option B is correct. The instance has a public IP (54.123.45.67), so it should be able to reach the internet. However, if the subnet does not have a route to the internet gateway, the instance cannot connect. Option A is wrong because the instance has a public IP. Option C is wrong because the security group allows outbound traffic. Option D is wrong because the instance state is running.

Answer

The instance does not have a public IP address.

Answer

The instance is not in a running state.

Answer

The security group is blocking outbound traffic.

Question 13

A company has an S3 bucket policy as shown in the exhibit. The bucket 'my-bucket' is owned by account 111111111111. What access does this policy grant to account 123456789012?

Accepted Answer

Full S3 access to the bucket and objects for the root user of account 123456789012.. Option A is correct. The policy allows the root user of account 123456789012 to perform all S3 actions on the bucket and its objects. Option B is wrong because the policy does not restrict to a specific user. Option C is wrong because the root user is allowed. Option D is wrong because the policy explicitly allows all actions.

Answer

Full S3 access to the bucket and objects for all IAM users in account 123456789012.

Answer

No access because the root user is not allowed.

Answer

Read-only access to the bucket.

Question 14

A company is designing a new application that requires a relational database with automated backups and multi-AZ redundancy. The database workload is predictable with occasional read replicas for reporting. Which AWS service should be used?

Accepted Answer

Amazon RDS. Option C is correct because Amazon RDS offers managed relational databases with automated backups and multi-AZ deployments. Option A is wrong because DynamoDB is NoSQL, not relational. Option B is wrong because Redshift is a data warehouse. Option D is wrong because ElastiCache is for caching.

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache

Question 15

A startup needs a serverless compute service to run code in response to S3 events. The code should execute within milliseconds and require no server management. Which AWS service should be used?

Accepted Answer

AWS Lambda. Option B is correct because AWS Lambda is serverless and can be triggered by S3 events. Option A is wrong because ECS manages containers, not serverless. Option C is wrong because Fargate is serverless but still container-based. Option D is wrong because EC2 is virtual servers.

Answer

Amazon ECS

Answer

Amazon EC2

Answer

AWS Fargate