SAP-C02 Design for New Solutions Practice Test 13 — 15 Questions

Question 1

A company is designing a microservices architecture on ECS with Fargate. Services need to communicate securely within a VPC and be accessible from the internet via an Application Load Balancer. The solution must minimize operational overhead. Which networking configuration should be used?

Accepted Answer

Services in private subnets with a NAT Gateway and an ALB in public subnets.. Option A is correct because placing services in private subnets with a NAT Gateway and ALB in public subnets provides secure internal communication and internet access. Option B is wrong because public subnets expose services directly. Option C is wrong because an NLB is for TCP, not HTTP. Option D is wrong because a single public subnet lacks redundancy.

Answer

Services in private subnets with a VPC endpoint and an NLB.

Answer

Services in a single public subnet with an ALB.

Answer

Services in public subnets with Internet Gateways and an ALB.

Question 2

A company needs to store configuration files for multiple environments (dev, test, prod) and retrieve them programmatically with versioning and access control. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store. Option D is correct because AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data with versioning and IAM policies. Option A is wrong because S3 is object storage, not specifically for config. Option B is wrong because Secrets Manager is for secrets. Option C is wrong because DynamoDB is NoSQL.

Answer

AWS Secrets Manager

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 3

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has a relational database with complex queries. The team wants to minimize changes to the existing codebase. Which database migration strategy should be recommended?

Accepted Answer

Use Amazon RDS for MySQL or PostgreSQL with read replicas.. Option C is correct because using Amazon RDS (same database engine) minimizes code changes as the application can connect via standard drivers. Option A is wrong because DynamoDB requires schema redesign. Option B is wrong because Aurora Serverless may require driver changes. Option D is wrong because S3 is for files.

Answer

Use Amazon Aurora Serverless to reduce management.

Answer

Store data in Amazon S3 and use Athena for queries.

Answer

Migrate to Amazon DynamoDB for scalability.

Question 4

A company wants to decouple a web application frontend from a backend processing service. The frontend sends jobs that are processed asynchronously. Which AWS service is best suited for this decoupling?

Accepted Answer

Amazon SQS. Option B is correct because Amazon Simple Queue Service (SQS) is a fully managed message queue for decoupling. Option A is wrong because SNS is pub/sub. Option C is wrong because Kinesis is for streaming. Option D is wrong because Step Functions is for workflows.

Answer

Amazon SNS

Answer

Amazon Kinesis

Answer

AWS Step Functions

Question 5

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudFront and AWS Shield. Option D is correct because CloudFront provides CDN with edge locations and AWS Shield Standard/Advanced provides DDoS protection. Option A is wrong because Route 53 is DNS, not CDN. Option B is wrong because Global Accelerator improves routing, not caching. Option C is wrong because WAF is for web application firewall, not DDoS.

Answer

AWS Global Accelerator and Amazon CloudFront

Answer

Amazon Route 53 and AWS Shield

Answer

AWS WAF and Amazon CloudFront

Question 6

A company needs to provide temporary credentials for users to access an S3 bucket for exactly 1 hour. The solution must not require any custom code or user management. Which AWS service should be used?

Accepted Answer

AWS STS. Option A is correct because AWS STS (Security Token Service) issues temporary credentials with configurable expiration. Option B is wrong because IAM roles are not directly assigned to users. Option C is wrong because Cognito is for user pools. Option D is wrong because S3 pre-signed URLs are for objects, not bucket-level access.

Answer

Amazon Cognito identity pools

Answer

An IAM role with a trust policy

Answer

S3 pre-signed URLs

Question 7

A company is designing a new application that will run on EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling strategy should be used?

Accepted Answer

Target tracking scaling policy. Option C is correct because a target tracking scaling policy automatically adjusts capacity based on a CloudWatch metric. Option A is wrong because scheduled scaling is for predictable patterns. Option B is wrong because simple scaling is less responsive. Option D is wrong because manual scaling is not automated.

Answer

Manual scaling by operations team

Answer

Simple scaling with a cooldown period

Answer

Scheduled scaling based on historical data

Question 8

A company is designing a new application that requires a highly available and durable NoSQL database. Which TWO services should be considered? (Choose TWO.)

Accepted Answer

Amazon DynamoDB. Options A and D are correct. DynamoDB is fully managed NoSQL with multi-AZ replication and Global Tables. Keyspaces is managed Cassandra. Option B is wrong because Neptune is graph. Option C is wrong because RDS is relational. Option E is wrong because DocumentDB is MongoDB-compatible, but not as fully managed NoSQL as the others.

Answer

Amazon DocumentDB

Answer

Amazon Neptune

Answer

Amazon RDS

Question 9

A company is designing a new microservices architecture that requires service discovery and API management. Which THREE services can be used together to achieve this? (Choose THREE.)

Accepted Answer

Amazon API Gateway. Options A, C, and D are correct. AWS Cloud Map provides service discovery, API Gateway manages APIs, and ALB can route traffic. Option B is wrong because Route 53 is DNS, not service discovery. Option E is wrong because VPC Lattice is for service-to-service communication, not API management.

Answer

Amazon Route 53

Answer

Amazon VPC Lattice

Question 10

A company is designing a data lake on S3 with sensitive data that must be encrypted at rest and audited. Which TWO services should be used? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options B and D are correct. AWS KMS provides encryption keys, and CloudTrail logs access to S3 buckets. Option A is wrong because SSE-S3 provides encryption but no audit. Option C is wrong because Macie is for data discovery, not encryption. Option E is wrong because GuardDuty is for threat detection.

Answer

S3 Server-Side Encryption (SSE-S3)

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 11

An IAM policy is attached to an IAM user. The user is testing from an IP address 10.0.1.5. What is the effect of the policy?

Accepted Answer

Allow PutObject in uploads/ only. Option B is correct because the first statement denies access due to IP condition, the second statement allows PutObject in uploads without IP restriction. So the user can upload to uploads/ but cannot get objects. Option A is wrong because the IP condition blocks GetObject. Option C is wrong because the second statement allows uploads. Option D is wrong because the second statement is valid.

Answer

Allow all actions on the bucket

Answer

Allow GetObject because the second statement overrides

Answer

Deny all actions because of IP mismatch

Question 12

A developer runs the above AWS CLI command. What is the expected output?

Accepted Answer

A list of instance IDs for running web-server instances. Option A is correct because the command filters for instances with tag Name=web-server and state running, then outputs the InstanceIds as text. Option B is wrong because it outputs only if instances exist. Option C is wrong because the filter is correct. Option D is wrong because the query selects InstanceId, not all info.

Answer

A list of public IP addresses

Answer

All instance IDs regardless of state

Answer

An error because the query syntax is incorrect

Question 13

An S3 bucket is created using the above CloudFormation template. What happens to objects in the bucket after 30 days?

Accepted Answer

Objects are permanently deleted. Option B is correct because the lifecycle rule expires objects after 30 days (deletes them). Option A is wrong because there is no transition. Option C is wrong because expiration deletes objects permanently. Option D is wrong because the rule is enabled.

Answer

Objects are transitioned to Glacier

Answer

The lifecycle rule is not applied because no prefix is specified

Answer

Objects are archived to S3 Standard-IA

Question 14

A company is designing a multi-tier web application on AWS. The application requires high availability across multiple Availability Zones. Which AWS service should be used to distribute incoming traffic across multiple EC2 instances in different Availability Zones?

Accepted Answer

Application Load Balancer. An Application Load Balancer distributes incoming traffic across targets such as EC2 instances in multiple Availability Zones, providing high availability. Option A (AWS Global Accelerator) improves performance but is not the primary choice for multi-AZ distribution. Option C (Amazon Route 53) is a DNS service. Option D (AWS Direct Connect) is for dedicated network connections.

Answer

AWS Global Accelerator

Answer

AWS Direct Connect

Answer

Amazon Route 53

Question 15

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to decouple the application into microservices while minimizing changes to the existing code. Which design approach is MOST cost-effective and requires the least code changes?

Accepted Answer

Use AWS App Runner for the existing application and add new microservices as separate App Runner services with a sidecar pattern. Using AWS App Runner with a sidecar pattern allows the existing application to run with minimal changes while adding microservices. Option A (refactoring to Lambda) requires significant code changes. Option B (using ECS with Fargate) involves containerization and orchestration. Option D (using Elastic Beanstalk) is simpler but does not inherently decouple into microservices.

Answer

Deploy the application on AWS Elastic Beanstalk and use Amazon RDS for MySQL

Answer

Refactor the application into AWS Lambda functions using an API Gateway

Answer

Containerize the application using Docker and run it on Amazon ECS with AWS Fargate, using Amazon RDS for MySQL