SAP-C02 Design for New Solutions Practice Test 12 — 15 Questions

Question 1

A company is deploying a web application on AWS that must scale automatically based on CPU utilization. The application runs on Amazon EC2 instances in an Auto Scaling group. Which configuration is required for the Auto Scaling group to scale based on CPU?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a step scaling policy based on a CloudWatch alarm for CPU utilization.. A step scaling policy allows the Auto Scaling group to adjust capacity in increments based on the severity of a CloudWatch alarm, such as one monitoring CPU utilization. This provides more granular and responsive scaling than simple policies, as it can add or remove instances in steps (e.g., add 2 instances when CPU > 70%, add 1 when CPU > 50%) and supports cooldown and warm-up logic to avoid thrashing.

Answer

Create a scheduled scaling action to add instances at peak times.

Answer

Create a simple scaling policy that adds one instance when CPU exceeds 50%.

Answer

Configure the ALB health check to mark instances unhealthy if CPU is high.

Question 2

A company is designing a serverless data processing pipeline using AWS Lambda to process messages from an Amazon SQS queue. The messages are generated by thousands of IoT devices. The architect needs to ensure that messages are processed in order within each device's stream and that failures are handled without data loss. Which combination of services should the architect use?

Accepted Answer

Use Amazon Kinesis Data Streams with Lambda function and a dead-letter queue. Amazon Kinesis Data Streams preserves the order of records within a shard, which maps to each device's stream when using a partition key like device ID. The Lambda function processes records from the stream, and a dead-letter queue captures any records that fail after the retry policy is exhausted, ensuring no data loss. This combination meets the requirements for ordered processing per device and fault tolerance without data loss.

Answer

Use Amazon Kinesis Data Firehose with Lambda function and an SQS queue for error handling

Answer

Use Amazon SQS standard queues with Lambda function and a dead-letter queue

Answer

Use Amazon SQS FIFO queues with Lambda function

Question 3

A financial services company needs to store transaction records for 7 years to meet regulatory requirements. The records must be retrievable within 24 hours of a request. The volume of data is 10 TB per year. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the most cost-effective storage class for data that must be retained for 7 years and retrieved within 24 hours, as it offers the lowest storage cost among AWS storage options while supporting retrieval times of 12–24 hours via standard retrieval. The 10 TB/year volume (70 TB total) and 24-hour retrieval window align perfectly with Glacier Deep Archive's design for long-term archival data that is rarely accessed.

Answer

Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Glacier with expedited retrieval

Answer

Amazon S3 Standard with lifecycle policies to transition to S3 Glacier after 1 year

Question 4

A company runs a critical workload on EC2 instances in an Auto Scaling group. The application is stateless and can handle instance failures. The architect needs to ensure that the application remains available during a regional outage. What is the MOST cost-effective and resilient architecture?

Accepted Answer

Use an active-passive configuration with Auto Scaling groups in two Regions and Route 53 failover. It provides multi-Region resilience using an active-passive architecture, which is the most cost-effective approach for a stateless application that must survive a regional outage. The active-passive setup uses Route 53 failover routing to direct traffic to the primary Region under normal conditions and automatically fail over to the secondary Region only when the primary is unhealthy, minimizing ongoing costs by keeping the secondary infrastructure idle or minimal until needed.

Answer

Deploy the Auto Scaling group in a single Region with instances spread across two AZs

Answer

Deploy the Auto Scaling group in three Availability Zones within a single Region

Answer

Use an active-active configuration across two Regions with Route 53 weighted routing

Question 5

A company has a multi-account AWS organization. The security team wants to centrally manage and enforce that all S3 buckets are encrypted with a specific KMS key. Which approach should the architect recommend?

Accepted Answer

Use a service control policy (SCP) to deny s3:PutBucketEncryption if the encryption is not the specified KMS key. A service control policy (SCP) can deny the s3:PutBucketEncryption action unless the encryption setting specifies the required KMS key. This centrally enforces the encryption requirement across all accounts in the AWS Organization, preventing any account from creating or modifying a bucket with non-compliant encryption, regardless of IAM permissions within that account.

Answer

Use AWS Trusted Advisor to check bucket encryption

Answer

Create an IAM policy that denies s3:PutObject unless the request includes the specific KMS key, and attach it to all users

Answer

Use AWS Config rules to detect non-compliant buckets and send alerts

Question 6

A company is designing a disaster recovery strategy for a production database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 1 hour. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Deploy Multi-AZ RDS instance and enable automatic failover. Option B is correct because a Multi-AZ RDS deployment maintains a synchronous standby replica in a second Availability Zone and automatically fails over in typically 60–120 seconds, which is well within the 15-minute RTO and provides an RPO of effectively zero (synchronous replication), satisfying the 1-hour RPO. Option E is correct because a cross-Region read replica uses asynchronous replication with a typical lag of seconds to a few minutes (well under the 1-hour RPO), and promoting it during a disaster can be completed in minutes, meeting the 15-minute RTO while also providing Region-level disaster recovery. Option A is not correct because AWS DMS export/import to S3 is a manual, batch-oriented process that cannot reliably achieve a 15-minute RTO or a 1-hour RPO. Option C is not correct because automated backups with point-in-time recovery are stored in the same Region, so they do not protect against a Region-wide disaster and restoring can exceed the 15-minute RTO. Option D is not correct because hourly manual snapshots give an RPO of up to 1 hour but restoring a snapshot in another Region typically takes far longer than 15 minutes, and the process is manual.

Answer

Export the database to Amazon S3 using AWS DMS and import in another Region

Answer

Use automated backups with point-in-time recovery in the same Region

Answer

Take manual snapshots every hour and restore in another Region

Question 7

A company is deploying a web application on AWS that must scale automatically based on CPU utilization. The application runs on Amazon EC2 instances in an Auto Scaling group. Which configuration is required for the Auto Scaling group to scale based on CPU?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the ALB target group to use HTTPS protocol. To encrypt traffic between the ALB and EC2 instances and restrict instance access to only the ALB, the architect must take two steps. First, configure the ALB target group to use HTTPS protocol (Option C) to encrypt traffic between the ALB and the backend instances. Second, configure the EC2 instance security group to allow inbound traffic only from the ALB's security group (Option D) to restrict access to only the ALB. The ALB listener HTTPS configuration (the null option) is for client-to-ALB encryption, which is not required by the security team's requirement; it is optional if end-to-end encryption is needed, but the question specifically asks for encryption between ALB and instances. Option A (same security group) would allow all traffic between the group members, not restrictive enough. Option B (public subnet) would expose instances directly to the internet. Option E (network ACLs) cannot reference security groups and is stateless, making it unsuitable.

Answer

Assign the same security group to the ALB and the instances

Answer

Place the EC2 instances in a public subnet

Answer

Use network ACLs to restrict inbound traffic to the ALB's IP addresses

Question 8

A company is building a data lake on Amazon S3. The data comes from various sources and must be encrypted at rest. The security policy requires that the encryption keys be managed by the company and rotated annually. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C). Option A (SSE-C) is correct because with server-side encryption using customer-provided keys, the company supplies and fully controls the encryption keys on every request, and S3 never stores them, so the company can rotate them annually per its own policy. Option C (SSE-KMS with a customer managed key) is correct because a customer managed KMS key is created, owned, and rotated by the company (automatic annual rotation can be enabled), satisfying both the company-managed key and annual rotation requirements. Option B (SSE-S3) is not correct because S3 fully manages and rotates the keys, so the company does not control them. Option D (default bucket encryption with SSE-S3) is not correct for the same reason—keys are AWS-managed, not company-managed. Option E (client-side encryption with the S3 encryption client) is not correct because it does not use S3 server-side encryption with company-managed keys as specified, and key management/rotation would fall outside the described SSE key-management model.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Enable default encryption on the S3 bucket with SSE-S3

Answer

Use client-side encryption with the Amazon S3 encryption client

Question 9

A company is designing a new application that requires a relational database. The application has variable traffic, with high spikes during business hours and low traffic at night. The company wants to minimize costs while ensuring the database can handle the spikes. Which solution should the architect recommend?

Accepted Answer

Use Amazon RDS with Multi-AZ and read replicas, or Amazon Aurora Serverless. Amazon Aurora Serverless automatically scales compute capacity based on application demand, making it ideal for variable traffic with high spikes during business hours and low traffic at night, while minimizing costs by only paying for consumed resources. Multi-AZ RDS with read replicas provides high availability and read scaling but does not automatically scale compute for write spikes, so Aurora Serverless is the more cost-effective and fully managed solution for this use case.

Answer

Use Amazon RDS with a Single-AZ instance and automatic scaling

Answer

Use Amazon DynamoDB with on-demand capacity

Answer

Use Amazon RDS with a Single-AZ instance and a large instance size

Question 10

A company is designing a new system that will ingest and process real-time streaming data from thousands of IoT devices. Each device sends data every second. The data must be processed with low latency (under 1 second) and then stored in Amazon S3 for long-term analytics. The company also needs to be able to reprocess data in case of processing errors. Which solution should the architect recommend?

Accepted Answer

Use Amazon Kinesis Data Streams to ingest data, AWS Lambda to process, and store in S3. Amazon Kinesis Data Streams provides sub-second ingestion latency, which meets the under-1-second processing requirement. AWS Lambda can process each record with low latency and store the results directly in Amazon S3. Kinesis Data Streams also supports data replay for up to 365 days (default 24 hours), enabling reprocessing in case of errors.

Answer

Use Amazon Kinesis Data Firehose to ingest data, transform with Lambda, and store in S3

Answer

Use AWS Database Migration Service (DMS) to ingest data into Amazon S3

Answer

Use Amazon SQS to buffer data, and an EC2 Auto Scaling group to process and store in S3

Question 11

A company is designing a new serverless application that uses Amazon API Gateway and AWS Lambda. The application must authenticate users using a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The company wants to offload authentication to the API Gateway. Which solution should the architect recommend?

Accepted Answer

Use an API Gateway COGNITO_USER_POOLS authorizer with Cognito configured as an OIDC client to the third-party IdP. It uses Amazon Cognito as an OIDC client to the third-party IdP, allowing API Gateway's COGNITO_USER_POOLS authorizer to validate tokens from the IdP without custom code. This offloads authentication entirely to API Gateway, as the authorizer checks the JWT token against the Cognito user pool, which trusts the IdP's OIDC tokens. The architecture meets the requirement of using a third-party IdP while keeping the serverless application simple and managed.

Answer

Use an API Gateway COGNITO_USER_POOLS authorizer

Answer

Use an API Gateway Lambda authorizer

Answer

Use an API Gateway IAM authorizer

Question 12

A company is designing a new application that will store sensitive customer data in Amazon S3. The data must be encrypted at rest. The company wants to use an encryption solution that provides an audit trail of when keys are used and by whom. The company also wants to rotate the encryption keys automatically every year. Which two options meet these requirements? (Choose TWO.)

Accepted Answer

Use client-side encryption with an AWS KMS managed key. Options B and E are correct because both leverage AWS KMS, which is the service that provides the required audit trail of key usage via AWS CloudTrail (recording every Encrypt, Decrypt, and GenerateDataKey call, including the calling principal) and supports automatic annual key rotation through KMS key rotation settings. Option E (SSE-KMS) encrypts objects server-side with a KMS customer managed key, so S3 calls KMS on the company's behalf and all key usage is logged in CloudTrail, while rotation is handled automatically by KMS. Option B (client-side encryption with an AWS KMS managed key) also satisfies the requirements because the application encrypts data before uploading using a KMS key, and every KMS API call is audited in CloudTrail with automatic yearly rotation available on the KMS key. Option A (SSE-S3) does not qualify because it uses S3-managed keys with no CloudTrail audit trail of individual key usage and no configurable automatic annual rotation. Option C (SSE-C) does not qualify because the customer supplies and manages the keys entirely, so AWS KMS provides no audit trail and no automatic rotation. Option D does not qualify because a master key stored in Secrets Manager is not integrated with KMS key usage auditing or KMS automatic rotation, so it lacks the required CloudTrail trail of key operations and yearly rotation.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Answer

Use client-side encryption with a master key stored in AWS Secrets Manager

Question 13

A company is designing a new web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be highly available across multiple Availability Zones. The company wants to ensure that if an EC2 instance fails, the load balancer stops sending traffic to it. Which two steps should the architect take? (Choose TWO.)

Accepted Answer

Configure a health check on the ALB for the target group. Configuring a health check on the ALB for the target group allows the load balancer to periodically send health check requests to each registered EC2 instance. If an instance fails to respond with a healthy status (e.g., HTTP 200) within the configured interval and threshold, the ALB automatically deregisters it and stops routing traffic to it, ensuring high availability and fault tolerance.

Answer

Use a Network Load Balancer instead of an ALB

Answer

Use an Application Load Balancer with a single target group

Answer

Launch all EC2 instances in a single Availability Zone

Question 14

A company is designing a disaster recovery solution for a critical application that runs on EC2 instances in a single AWS Region. The application uses a custom AMI that is updated weekly. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 4 hours. The solution must minimize cost while meeting these objectives. Which approach should be used?

Accepted Answer

Use EC2 Image Builder to create an updated AMI weekly and replicate it to another Region, then launch instances from the replicated AMI in the DR Region.. The solution must meet RPO of 15 minutes and RTO of 4 hours while minimizing cost. Using EC2 Image Builder to create an updated AMI weekly and replicating it to another Region, then launching instances from the replicated AMI in the DR Region, meets the RTO (instances can be launched within 4 hours) and RPO (data can be restored from backups or replicated separately). This approach is cost-effective because it avoids continuous replication costs and only incurs AMI storage and replication costs.

Answer

Use Amazon S3 cross-region replication to copy the application data to a bucket in another Region.

Answer

Use AWS CloudEndure Disaster Recovery for continuous replication of the entire server.

Answer

Manually create an AMI of the instance every week and copy it to another region using the AWS Management Console.

Question 15

A company is designing a serverless data processing pipeline. An AWS Lambda function processes records from an Amazon Kinesis Data Stream. The function runs for an average of 30 seconds per record, and the stream has 10 shards. The company expects a sustained load of 5,000 records per second. What is the primary consideration to ensure the Lambda function can scale to handle the load?

Accepted Answer

Ensure that the Lambda function processes each batch within the Kinesis stream's iterator age.. The primary consideration is to ensure that the Lambda function processes each batch within the Kinesis stream's iterator age (default 7 days). With 5,000 records/sec across 10 shards, each shard receives 500 records/sec. If each record takes 30 seconds to process, the Lambda function must process records faster than they arrive to avoid falling behind and exceeding the iterator age, which would cause data loss. The iterator age metric tracks how far behind the consumer is, and if it grows unbounded, records will expire before being processed.

Answer

Request a service quota increase for Lambda concurrent executions.

Answer

Set a reserved concurrency of 500 for the Lambda function.

Answer

Increase the Lambda function timeout to more than 30 seconds.