SAP-C02 Design for New Solutions Practice Test 13 — 15 Questions

Question 1

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant retrieval) based on changing access patterns, ensuring that frequently queried data remains in low-latency tiers for immediate query performance with Athena and Redshift Spectrum, while reducing storage costs for data that becomes less active. This is ideal for a petabyte-scale data lake where access patterns are unpredictable or vary over time, as it avoids manual tier management and the retrieval delays of archive classes.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 2

A company wants to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances. This makes it the ideal choice for persistent storage that must be shared across containers running on different EC2 instances, as it supports the NFSv4.1 and NFSv4.0 protocols and automatically scales storage capacity as files are added or removed.

Answer

EC2 Instance Store

Answer

Amazon S3

Answer

Amazon EBS

Question 3

A company is designing a new solution to ingest real-time clickstream data from a website. The data volume varies from 100 to 100,000 events per second. The solution must buffer the data for up to 5 minutes and then deliver it to Amazon S3 for analysis. The company wants to minimize operational overhead and cost. Which service should be used to buffer the data?

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to ingest streaming data, buffer it for configurable durations (up to 15 minutes by default, but easily set to 5 minutes), and automatically deliver it to destinations like Amazon S3. It handles variable data volumes (100 to 100,000 events per second) without requiring manual scaling, minimizing operational overhead and cost compared to alternatives.

Answer

Amazon Kinesis Data Streams

Answer

AWS Lambda

Answer

Amazon SQS

Question 4

A company is designing a new microservices architecture using AWS Lambda. Each microservice has its own database. The company wants to securely store database credentials and rotate them automatically. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like Amazon RDS, Redshift, and DocumentDB. It supports built-in rotation with AWS Lambda, ensuring credentials are rotated on a schedule without manual intervention, which directly meets the requirement for automatic rotation in a microservices architecture.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM)

Question 5

A company is designing a multi-region active-active application using Amazon DynamoDB global tables. The application requires strong consistency reads. However, global tables only support eventual consistency. What should the solutions architect do to meet the requirement?

Accepted Answer

Design the application to handle eventual consistency using conditional writes and application logic.. DynamoDB global tables inherently replicate data asynchronously across regions, which means they only support eventual consistency. To meet strong consistency requirements in an active-active multi-region setup, the application must be designed to handle eventual consistency by using conditional writes and application logic to manage conflicts and ensure data integrity. This approach acknowledges the technical limitation of global tables while still achieving the desired consistency level through careful application design.

Answer

Enable strong consistency in the global table configuration.

Answer

Use DynamoDB Streams to replicate data to another region with strong consistency.

Answer

Use DynamoDB Accelerator (DAX) to provide strong consistency reads.

Question 6

A company is designing a new serverless application using AWS Lambda to process high-resolution images uploaded to Amazon S3. Each image can be up to 500 MB. The processing must complete within 5 minutes. What is the MOST cost-effective and scalable design to meet these requirements?

Accepted Answer

Configure S3 event notifications to invoke a Lambda function that processes the image in memory and writes the result to another S3 bucket.. Lambda can directly process images up to 500 MB within its 15-minute timeout (5 minutes is well within limits), and processing in memory avoids the latency and cost of intermediate storage or compute. S3 event notifications invoke Lambda synchronously, making this the most cost-effective and scalable design for serverless image processing.

Answer

Use S3 event notifications to send the image to an Amazon SQS queue, then process it with a Lambda function.

Answer

Use AWS Fargate to run a containerized image processing service triggered by S3 event notifications.

Answer

Use AWS Step Functions to orchestrate a Lambda function and an EC2 instance for processing.

Question 7

A financial services company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets in any account have server-side encryption enabled using AWS KMS (SSE-KMS) with a customer managed key. Additionally, they want to prevent any S3 bucket from being publicly accessible. What is the MOST efficient and comprehensive way to enforce these policies?

Accepted Answer

Create an SCP that denies s3:PutObject without the x-amz-server-side-encryption-aws:kms header, and another SCP that denies s3:PutBucketPublicAccessBlock with a condition key. Also, use a resource-based policy on the S3 service to block public access.. SCPs can deny the s3:PutObject action unless the x-amz-server-side-encryption-aws:kms header is present, ensuring SSE-KMS is enforced at the API level across all accounts. Additionally, an SCP denying s3:PutBucketPublicAccessBlock with a condition key (e.g., requiring the PublicAccessBlockConfiguration to be fully enabled) prevents any bucket from being made publicly accessible. This approach is comprehensive and efficient as it proactively blocks non-compliant actions before they occur, rather than relying on reactive remediation.

Answer

Use a service control policy (SCP) to deny the s3:PutBucketAcl action that grants public access, and rely on bucket policies to enforce encryption.

Answer

Use AWS Config rules with automatic remediation to enable encryption and block public access on any non-compliant bucket.

Answer

Create an SCP that denies the s3:PutBucketPublicAccessBlock action and attach it to the root OU.

Question 8

A startup is building a web application on AWS that requires a relational database. They expect unpredictable traffic patterns and want to minimize costs while ensuring high availability. Which database solution should they choose?

Accepted Answer

Amazon Aurora Serverless (MySQL-compatible). Amazon Aurora Serverless (MySQL-compatible) is the correct choice because it automatically scales compute capacity based on actual application demand, making it ideal for unpredictable traffic patterns. It provides high availability through multi-AZ storage and automated failover, while minimizing costs by only charging for consumed capacity during active periods.

Answer

Amazon Redshift with concurrency scaling

Answer

Amazon RDS for MySQL with Single-AZ deployment

Answer

Amazon DynamoDB with on-demand capacity

Question 9

A media company is designing a video transcoding pipeline. They receive raw video files in Amazon S3, which need to be transcoded into multiple formats. The pipeline must handle sporadic bursts of uploads and complete processing within 30 minutes for each video. The cost should be minimized. Which design should they use?

Accepted Answer

Use Amazon S3 event notifications to trigger an AWS Elemental MediaConvert job.. AWS Elemental MediaConvert is a fully managed, serverless video transcoding service designed for high-volume, bursty workloads. It integrates directly with S3 event notifications, scales automatically to handle sporadic uploads, and completes each job within the required 30-minute window. Its pay-per-use pricing minimizes cost by eliminating idle infrastructure, unlike provisioned EC2 clusters or Lambda's 15-minute execution limit.

Answer

Use AWS Lambda with layers containing FFmpeg to transcode videos.

Answer

Provision a cluster of EC2 instances running FFmpeg, with Auto Scaling based on SQS queue depth.

Answer

Use Amazon Elastic Transcoder, which is fully managed and triggers from S3 events.

Question 10

A company is designing a disaster recovery (DR) solution for a critical application running on Amazon EC2 instances in a single AWS Region. The DR site will be in a different Region. The application data is stored in an Amazon RDS for MySQL DB instance with Multi-AZ enabled. The Recovery Point Objective (RPO) is 15 minutes, and the Recovery Time Objective (RTO) is 2 hours. Which strategy meets these requirements MOST cost-effectively?

Accepted Answer

Configure a cross-Region read replica for the RDS MySQL DB instance. In the DR event, promote the read replica to a standalone instance.. The most cost-effective strategy because a cross-Region read replica for RDS MySQL allows continuous replication with minimal overhead, achieving an RPO of seconds to minutes and an RTO of minutes (promotion time). It avoids the cost of a full Aurora Global Database or the RPO gap from daily snapshots, meeting the 15-minute RPO and 2-hour RTO requirements at lower cost.

Answer

Take daily automated snapshots of the RDS DB instance and copy them to the DR Region. In the DR Region, restore the DB instance from the latest snapshot.

Answer

Use Amazon Aurora Global Database to replicate data across Regions.

Answer

Use AWS Backup to copy backups to the DR Region and set up EC2 Image Builder for application recovery.

Question 11

A company is designing a microservices architecture on Amazon ECS with Fargate. They want to ensure that services can communicate with each other but are isolated from the internet. What is the MOST secure way to achieve this?

Accepted Answer

Place all ECS services in private subnets and use AWS Cloud Map for service discovery.. Placing ECS services in private subnets ensures they have no direct internet access, while AWS Cloud Map provides a secure, DNS-based service discovery mechanism that allows services to communicate internally using private IP addresses. This design eliminates exposure to the internet and leverages AWS's native service discovery for dynamic microservices.

Answer

Use VPC peering to connect the subnets of each service.

Answer

Use AWS PrivateLink to create VPC endpoints for each service.

Answer

Place services in public subnets and use security groups to restrict inbound traffic.

Question 12

A company is designing a data lake on Amazon S3. Data is ingested from various sources, including IoT devices, and must be stored in a cost-effective manner. The data access patterns are unpredictable; some data is accessed frequently for a few days, then rarely accessed. The company wants to minimize storage costs while ensuring data is available within minutes when accessed. Which storage class should they use for the data?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct choice because it automatically moves data between two access tiers (frequent and infrequent access) based on changing access patterns, with no retrieval fees. This matches the unpredictable access pattern described—data accessed frequently for a few days then rarely—while ensuring data is available within minutes (milliseconds latency). It minimizes storage costs by charging lower rates for infrequently accessed data without requiring manual lifecycle management.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-Infrequent Access

Question 13

A company is designing a new application on AWS that uses Amazon API Gateway and AWS Lambda to expose a RESTful API. The API must authenticate requests using OAuth 2.0 with an external identity provider (IdP). The company wants to offload the authentication logic to the API Gateway. Which API Gateway feature should they use?

Accepted Answer

Configure a Lambda authorizer to validate the OAuth 2.0 token.. A Lambda authorizer (formerly known as a custom authorizer) allows API Gateway to call a Lambda function that validates the OAuth 2.0 token (e.g., JWT) from the external IdP. This offloads authentication logic from the backend Lambda to API Gateway, enabling centralized token validation before the request reaches the integration.

Answer

Use API Gateway's WebSocket API.

Answer

Enable API Gateway's VPC Link.

Answer

Use usage plans with API keys.

Question 14

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions. What should they do?

Accepted Answer

Enable sticky sessions on the ALB using duration-based cookies.. Application Load Balancers natively support sticky sessions (session affinity) using duration-based cookies. The ALB generates a cookie (AWSALB) that binds a user's session to a specific target instance for the duration of the cookie's lifetime, ensuring consistent user experience without external dependencies.

Answer

Configure an Amazon CloudFront distribution with session affinity.

Answer

Store session data in Amazon ElastiCache and use a cookie to reference it.

Answer

Use a Network Load Balancer (NLB) with cross-zone load balancing.

Question 15

A company is designing a new serverless data processing pipeline that uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be processed using AWS Lambda and then stored in Amazon S3. The company needs to ensure that records are processed in order within each shard and that each record is processed exactly once. Which configuration should they use? (Choose TWO.)

Accepted Answer

Use the Kinesis Client Library (KCL) and implement deduplication logic in the Lambda function.. The correct options are D and E. Using the Kinesis Client Library (KCL) with deduplication logic ensures exactly-once processing and maintains per-shard ordering. Configuring the Lambda function with a reserved concurrency of 1 limits the function to a single concurrent execution, which can enforce sequential processing across shards and help preserve order, though it is not a scalable per-shard solution. Option A is incorrect because SQS FIFO adds unnecessary complexity and does not preserve Kinesis shard ordering natively. Option B is incorrect because the batch window only affects invocation latency, not ordering or exactly-once semantics. Option C is incorrect because enabling parallelization factor allows concurrent batches per shard, breaking strict ordering.

Answer

Use an Amazon SQS FIFO queue between Kinesis and Lambda to ensure ordering.

Answer

Increase the batch window to reduce the number of Lambda invocations.

Answer

Enable parallelization factor on the Lambda event source mapping.