SAP-C02 Design for New Solutions Practice Test 15 — 15 Questions

Question 1

A company is migrating a legacy monolithic application to a microservices architecture on AWS. They want to use an event-driven design where services react to state changes. Which AWS service should they use to capture, store, and replay events?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon EventBridge. Amazon EventBridge is a serverless event bus that can ingest events from AWS services, custom applications, and SaaS partners. It stores events in an event archive and allows replaying them to consumers, which fits the requirement to capture, store, and replay events for an event-driven microservices architecture.

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Answer

Amazon SQS

Question 2

A company wants to deploy a containerized web application on AWS. They need to manage container orchestration, automatic scaling, and service discovery. Which AWS services should they use? (Select TWO.)

Accepted Answer

Amazon Elastic Container Service (ECS). Amazon ECS and Amazon EKS both provide container orchestration, automatic scaling, and service discovery. ECS is a fully managed container orchestration service tightly integrated with AWS, while EKS offers Kubernetes-based orchestration. Both meet the requirements, so options B and C are correct. Lightsail is for simple VMs or containers, not full orchestration. Elastic Beanstalk is a PaaS service that can deploy containers but lacks native container orchestration features.

Answer

Amazon Lightsail

Answer

AWS Elastic Beanstalk

Question 3

A company wants to provide temporary access to an S3 bucket for external partners. The access must be time-limited and restricted to specific objects. Which AWS service or feature should they use?

Accepted Answer

Presigned URLs. S3 presigned URLs embed the requester's credentials and an expiration into a URL, granting time-limited access to a specific object without requiring the partner to have AWS credentials. The URL can be scoped to a single object and set to expire in minutes or hours, satisfying both the time-limit and object-restriction requirements.

Answer

S3 bucket policies

Answer

CloudFront signed URLs

Answer

IAM roles

Question 4

A company is designing a new application on AWS that requires high availability and disaster recovery across multiple AWS Regions. The application uses an Amazon RDS for MySQL database. Which TWO strategies should they implement to meet these requirements?

Accepted Answer

Enable automated backups and copy them to another Region.. Option B is correct because enabling automated backups on the RDS for MySQL instance and configuring cross-Region automated backup replication provides continuous, point-in-time recovery capability in a second Region, which supports disaster recovery across Regions. Option D is correct because a cross-Region read replica maintains an asynchronously replicated copy of the MySQL database in another Region, enabling both read scaling and a fast promotion path for regional failover. Option A is not ideal because a manual snapshot copy is a one-time, point-in-time operation that does not provide ongoing replication or low RPO/RTO for disaster recovery. Option C is incorrect because S3 cross-Region replication applies to S3 objects, not to RDS database storage or transaction logs. Option E is incorrect because Multi-AZ deployment provides high availability within a single Region by synchronously replicating to a standby in another Availability Zone, but it does not provide cross-Region disaster recovery.

Answer

Create a manual snapshot and copy it to another Region.

Answer

Use S3 cross-Region replication for the database.

Answer

Enable Multi-AZ deployment.

Question 5

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. They need to ensure that the application can handle a sudden increase in traffic without losing any data or causing errors. Which THREE strategies should they implement?

Accepted Answer

Use DynamoDB on-demand capacity mode.. Option A is correct because DynamoDB on-demand capacity mode instantly accommodates sudden traffic spikes without requiring capacity planning, so requests are not throttled and data is not lost. Option C is correct because DynamoDB auto scaling adjusts provisioned read/write capacity in response to changing traffic patterns, maintaining throughput during surges when provisioned mode is used. Option E is correct because configuring Lambda reserved concurrency guarantees a set number of concurrent executions for the function, preventing it from being throttled by account-level concurrency limits and ensuring requests are processed reliably. Option B is not required because SQS decoupling adds buffering but is not essential to prevent DynamoDB or Lambda errors in this scenario. Option D is not required because DAX reduces read latency for eventually consistent reads but does not address write scaling or sudden traffic surges for data durability.

Answer

Decouple the application with Amazon SQS.

Answer

Use DynamoDB Accelerator (DAX) for caching.

Question 6

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. They need to store session state for the application. Which TWO services can they use for this purpose?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis (option D) is correct because it is an in-memory data store that supports sub-millisecond latency and native data structures like hashes and strings, making it a standard choice for storing and retrieving session state for web applications running on ECS with Fargate. Amazon DynamoDB (option E) is also correct because it is a fully managed, serverless NoSQL key-value store with single-digit millisecond latency and automatic scaling, which is well suited for persisting session data keyed by session ID without managing infrastructure. Amazon EFS (option A) is a shared file system, not a session-state store, and would introduce unnecessary file-locking and latency overhead. Amazon RDS (option B) is a relational database that can technically store sessions but is not optimized for the high-throughput, low-latency key-value access pattern typical of session state. Amazon S3 (option C) is object storage with higher latency and eventual consistency characteristics that make it unsuitable for frequent session reads and writes.

Answer

Amazon EFS

Answer

Amazon RDS

Answer

Amazon S3

Question 7

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from the 'confidential' folder in 'my-bucket' using HTTP (not HTTPS). What will happen?

Accepted Answer

The request is denied because the second statement explicitly denies access when using HTTP.. The second statement in the IAM policy contains an explicit Deny for requests where aws:SecureTransport is false (i.e., HTTP). In AWS IAM, an explicit Deny always overrides any Allow, so even though the first statement allows s3:GetObject from a specific IP range, the HTTP request is blocked by the Deny. Therefore, the request is denied because the second statement explicitly denies access when using HTTP.

Answer

The request is denied because the second statement denies access from the IP range.

Answer

The request is denied because the first statement only allows from a specific IP range.

Answer

The request is allowed because the first statement allows s3:GetObject.

Question 8

Refer to the exhibit. A solutions architect runs the CLI command and gets the output shown. What does the state 'running' indicate about the instance?

Accepted Answer

The instance is running and has passed its status checks.. The CLI command `aws ec2 describe-instance-status` returns the instance state as 'running' and the instance status as 'ok'. The 'running' state in the output refers to the EC2 instance's lifecycle state, but the question specifically asks what the 'running' state indicates about the instance. In the context of `describe-instance-status`, the 'running' state shown is the instance's lifecycle state, which means the instance is powered on and has passed its initial boot. However, the correct interpretation here is that the instance is running and has passed its status checks (both system status and instance status are 'ok'), as indicated by the full output. Option C is correct because the output shows the instance is in the 'running' state and all status checks have passed.

Answer

The instance is pending.

Answer

The instance is stopped.

Answer

The instance is terminated.

Question 9

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket. After deployment, the bucket is created but objects are not automatically deleted after 30 days as expected. What is the most likely cause?

Accepted Answer

The lifecycle rule only applies to noncurrent versions, not current objects.. The lifecycle rule in the template likely uses `NoncurrentVersionExpirationInDays`, which only applies to noncurrent versions, not current objects. To delete current objects after 30 days, an `ExpirationInDays` rule is needed. Versioning being enabled (option C) is necessary for the noncurrent version expiration to work, but the issue is that current objects are not expiring. The bucket name conflict (option B) would cause a deployment failure, not a lifecycle misconfiguration. Region-specific prefix (option D) is not required for lifecycle rules.

Answer

The bucket name conflicts with an existing bucket.

Answer

Versioning is not enabled on the bucket.

Answer

The lifecycle rule requires a region-specific prefix.

Question 10

A company is designing a new application that will process streaming data from IoT devices. They need to ingest data in real time and apply transformations before storing it in Amazon S3. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) is the correct choice because the question explicitly requires applying transformations to streaming data in real time before storing it in Amazon S3. Kinesis Data Analytics allows you to run SQL or Apache Flink applications directly on streaming data to perform transformations, aggregations, and filtering, and then output the results to a destination like Amazon S3 via Kinesis Data Firehose.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Answer

AWS Lambda

Question 11

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

Accepted Answer

Access is denied because the IP is not allowed.. The bucket policy explicitly denies access to all principals except those coming from the allowed IP address range (which does not include 198.51.100.5). In AWS IAM, an explicit deny overrides any allow, so the request from IP 198.51.100.5 is denied. Option D is correct because the policy's condition block restricts access to a specific IP range, and the user's IP is not within that range.

Answer

Access is allowed because the Principal is "*".

Answer

Access is denied because the bucket is not public.

Answer

Access is allowed because the policy does not explicitly deny.

Question 12

The above CLI output shows the state of a CloudWatch alarm. The EC2 instance's CPU utilization averaged 85% for the last 10 minutes. What is the alarm state?

Accepted Answer

ALARM. The CLI output indicates that the alarm state is 'ALARM' because the EC2 instance's CPU utilization averaged 85% for the last 10 minutes, which exceeds the alarm threshold (typically set at, for example, 80% for a standard CPU utilization alarm). CloudWatch alarms transition to ALARM when the metric breaches the threshold for the specified evaluation periods, and here the sustained high utilization over the 10-minute window meets that condition.

Answer

OK

Answer

INSUFFICIENT_DATA

Answer

ERROR

Question 13

A company is designing a new web application with a global user base. They need to improve latency for static content and protect against DDoS attacks. Which services should they use? (Choose THREE.)

Accepted Answer

AWS Shield. Amazon CloudFront (E) is correct because it is AWS's global content delivery network, caching static content at edge locations worldwide to reduce latency for a global user base. AWS Shield (A) is correct because it provides managed DDoS protection, with Shield Advanced offering enhanced mitigation for large-scale attacks against CloudFront and other resources. AWS WAF (D) is correct because it filters and monitors HTTP(S) requests using web ACL rules, protecting the web application from common exploits like SQL injection and cross-site scripting that often accompany DDoS attempts. AWS Global Accelerator (B) is not marked correct because it optimizes traffic routing for dynamic, non-cacheable workloads rather than static content delivery. Amazon Route 53 (C) is not marked correct because, while it provides DNS resolution and routing policies, it does not itself cache static content or provide DDoS mitigation or web application firewall capabilities.

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 14

A company is deploying a multi-tier web application on AWS. The application must be highly available across three Availability Zones. The web tier runs on EC2 instances behind an Application Load Balancer (ALB). The application tier runs on EC2 instances behind a Network Load Balancer (NLB). The database tier uses a Multi-AZ RDS instance. To reduce cross-AZ data transfer costs, which design should be implemented?

Accepted Answer

Place web and application tier instances in the same subnets across all three AZs. Placing web and application tier EC2 instances in the same subnets across all three Availability Zones ensures that traffic between the ALB and NLB, as well as between the NLB and application instances, stays within the same AZ whenever possible. This design leverages the ALB's cross-zone load balancing behavior (enabled by default) and the NLB's ability to route traffic to targets in the same AZ, minimizing cross-AZ data transfer costs. AWS charges for data transfer between AZs, so keeping traffic within the same AZ reduces those costs while maintaining high availability across three AZs.

Answer

Use AWS Global Accelerator to reduce data transfer costs

Answer

Place all web tier instances in one AZ and all application tier instances in another AZ

Answer

Use a single AZ for all tiers to avoid cross-AZ traffic

Question 15

A company is designing a new application that will store sensitive user data in Amazon S3. The data must be encrypted at rest and in transit. The solution must use AWS managed keys and must be compliant with PCI DSS. Which combination of encryption options should be used?

Accepted Answer

SSE-S3 for at-rest encryption and HTTPS for in-transit encryption. SSE-S3 provides server-side encryption at rest using AWS-managed keys (S3-managed keys), which satisfies the requirement for AWS managed keys. HTTPS ensures encryption in transit, and both are compliant with PCI DSS standards for protecting sensitive data.

Answer

Client-side encryption for at-rest and HTTPS for in-transit

Answer

SSE-KMS for at-rest encryption and HTTP for in-transit encryption

Answer

SSE-C for at-rest encryption and HTTPS for in-transit