SAP-C02 Design for New Solutions Practice Test 15 — 15 Questions

Question 1

A company is designing a data lake on S3 with sensitive data that must be encrypted at rest and audited. Which TWO services should be used? (Choose TWO.)

Accepted Answer

AWS CloudTrail. To meet the requirements of encrypting data at rest and auditing access, two services are needed. AWS KMS (Key Management Service) provides centralized control over encryption keys and can be used with S3 Server-Side Encryption (SSE-KMS) to encrypt sensitive data at rest. AWS CloudTrail records all API calls made to S3, enabling auditing of who accessed or modified the data. Together, KMS and CloudTrail satisfy both the encryption and auditing requirements.

Answer

S3 Server-Side Encryption (SSE-S3)

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 2

An IAM policy is attached to an IAM user. The policy allows the `s3:PutObject` action on the resource `arn:aws:s3:::my-bucket/uploads/*` with a condition that the request must come from IP address `10.0.1.5`. The user is testing from an IP address `10.0.1.5`. What is the effect of the policy?

Accepted Answer

Allow PutObject in uploads/ only. The attached IAM policy grants permission to perform PutObject on the 'uploads/' prefix, and the IP address condition matches the user's test IP (10.0.1.5). Therefore, the effect is to allow PutObject specifically on objects within the 'uploads/' folder.

Answer

Allow all actions on the bucket

Answer

Allow GetObject because the second statement overrides

Answer

Deny all actions because of IP mismatch

Question 3

A developer runs the above AWS CLI command. What is the expected output?

Accepted Answer

A list of instance IDs for running web-server instances. The AWS CLI command uses `describe-instances` with a `--filters` parameter to select only instances with a tag `Name=web-server` and a state of `running`. The `--query` parameter then extracts the `InstanceId` values from the result. Therefore, the output is a list of instance IDs for running web-server instances, making option B correct.

Answer

A list of public IP addresses

Answer

All instance IDs regardless of state

Answer

An error because the query syntax is incorrect

Question 4

An S3 bucket is created using the above CloudFormation template. What happens to objects in the bucket after 30 days?

Accepted Answer

Objects are permanently deleted. The CloudFormation template defines a lifecycle rule with an expiration action that deletes objects after 30 days. Since no prefix is specified, the rule applies to all objects in the bucket. After 30 days, objects are permanently deleted, not transitioned to another storage class.

Answer

Objects are transitioned to Glacier

Answer

The lifecycle rule is not applied because no prefix is specified

Answer

Objects are archived to S3 Standard-IA

Question 5

A company is designing a multi-tier web application on AWS. The application requires high availability across multiple Availability Zones. Which AWS service should be used to distribute incoming traffic across multiple EC2 instances in different Availability Zones?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) operates at Layer 7 of the OSI model and is designed to distribute incoming HTTP/HTTPS traffic across multiple targets, such as EC2 instances, in different Availability Zones. By registering instances in multiple AZs and enabling cross-zone load balancing, the ALB provides high availability and fault tolerance for the multi-tier web application.

Answer

AWS Global Accelerator

Answer

AWS Direct Connect

Answer

Amazon Route 53

Question 6

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to decouple the application into microservices while minimizing changes to the existing code. Which design approach is MOST cost-effective and requires the least code changes?

Accepted Answer

Use AWS App Runner for the existing application and add new microservices as separate App Runner services with a sidecar pattern. AWS App Runner allows you to run the existing monolithic application with minimal code changes by simply pointing it at a container image or source code, while new microservices can be added as separate App Runner services. The sidecar pattern enables you to attach auxiliary processes (e.g., logging, monitoring) without modifying the core application code, making this the most cost-effective and least disruptive approach for decoupling into microservices.

Answer

Deploy the application on AWS Elastic Beanstalk and use Amazon RDS for MySQL

Answer

Refactor the application into AWS Lambda functions using an API Gateway

Answer

Containerize the application using Docker and run it on Amazon ECS with AWS Fargate, using Amazon RDS for MySQL

Question 7

A company is designing a data lake on AWS using Amazon S3. The data lake will store sensitive customer data that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which solution meets these requirements?

Accepted Answer

Use client-side encryption with keys stored in AWS CloudHSM and rotate the keys using CloudHSM key rotation. The company requires encryption keys to be managed by its own HSM and rotated every 90 days. AWS CloudHSM provides a dedicated HSM appliance that the customer fully controls, and client-side encryption ensures that the encryption keys never leave the customer's HSM environment. The customer can implement key rotation within CloudHSM using its native key management capabilities, meeting both the HSM control and 90-day rotation requirements.

Answer

Use SSE-S3 (Amazon S3 managed keys) and configure a lifecycle policy to re-encrypt objects every 90 days

Answer

Use SSE-KMS with a customer managed key and configure automatic key rotation every 90 days

Answer

Use SSE-C (customer-provided keys) and provide the key with each PUT request, rotating the key every 90 days

Question 8

A company is designing a serverless application that processes images uploaded to an S3 bucket. The processing must be asynchronous and can take up to 15 minutes per image. Which AWS service should be used to trigger the processing?

Accepted Answer

Configure S3 Event Notifications to send an event to an Amazon SQS queue, which is polled by an AWS Lambda function. S3 Event Notifications can asynchronously deliver events to an SQS queue, and an AWS Lambda function can poll that queue. This decouples the processing from the S3 upload, allowing the Lambda function to handle the 15-minute processing limit asynchronously without timing out, since Lambda's maximum execution time is 15 minutes.

Answer

Configure S3 Event Notifications to publish a message to an Amazon SNS topic, which triggers an AWS Lambda function

Answer

Configure S3 Event Notifications to invoke an AWS Lambda function synchronously

Answer

Use Amazon EventBridge to capture S3 events and trigger an AWS Step Functions workflow

Question 9

A company is deploying a web application on AWS. The application requires a relational database with read replicas for scaling read queries. The database must support automatic failover and be Multi-AZ. Which database solution meets these requirements?

Accepted Answer

Amazon Aurora with Multi-AZ and Aurora Replicas. Amazon Aurora with Multi-AZ and Aurora Replicas (Option B) is the correct choice because it provides a single integrated solution where Aurora Replicas serve as both read replicas for scaling read queries and automatic failover targets. In contrast, Amazon RDS for MySQL with Multi-AZ and Read Replicas (Option D) uses a separate Multi-AZ standby for failover and read replicas that are not automatically promoted; while it technically meets the individual requirements, it does not provide the combined failover and read scaling within the same tier, making Aurora the preferred solution. Option A is a NoSQL database, not relational. Option C is a caching service, not a relational database.

Answer

Amazon DynamoDB with global tables

Answer

Amazon ElastiCache for Redis with replication groups

Answer

Amazon RDS for MySQL with Multi-AZ and Read Replicas

Question 10

A company wants to provide temporary, limited-privilege credentials to its application running on an EC2 instance so that the application can access an S3 bucket. What is the BEST practice for achieving this?

Accepted Answer

Create an IAM role with the necessary permissions and attach it to the EC2 instance. The best practice is to use an IAM role, which provides temporary security credentials via the EC2 instance metadata service (IMDS). The application automatically retrieves these credentials without hardcoding secrets, and the credentials are rotated automatically by AWS. This approach follows the principle of least privilege and eliminates the security risks of long-term access keys.

Answer

Use an S3 bucket policy to allow access from the EC2 instance's public IP

Answer

Create an IAM user and store the credentials in the EC2 instance user data

Answer

Store AWS access keys in the application code

Question 11

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which approach provides the BEST security and performance?

Accepted Answer

Use AWS App Mesh for service-to-service communication with mutual TLS. AWS App Mesh provides a service mesh that enables secure, encrypted service-to-service communication using mutual TLS (mTLS), which authenticates both sides of the connection and encrypts traffic in transit. It also offers observability, traffic control, and retry logic at the application layer, making it the best choice for microservices on ECS Fargate where security and performance are critical.

Answer

Use VPC peering between the services' VPCs

Answer

Use an internet-facing Application Load Balancer for each service

Answer

Use an internal Network Load Balancer for each service

Question 12

A company is designing a disaster recovery (DR) strategy for a critical application. The application runs on EC2 instances in a single AWS Region. The company needs a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon DynamoDB global tables for the database and deploy EC2 instances in a warm standby configuration in another Region. Amazon DynamoDB global tables provide automatic, asynchronous replication across multiple AWS Regions with an RPO of typically less than 1 second, easily meeting the 15-minute RPO. Combined with a warm standby configuration of EC2 instances in the secondary Region, you can quickly fail over within the 2-hour RTO using Route 53 or other DNS mechanisms. Option C is incorrect because Application Load Balancers (ALBs) are regional in scope and do not support cross-Region load balancing. ALB cannot directly route traffic to targets in another Region, so the described architecture would not achieve cross-Region failover as intended. Options A and B involve replication mechanisms (S3 CRR and EBS snapshots) that cannot guarantee the 15-minute RPO due to asynchronous delays and manual recovery steps. Option E describes an Active-Passive configuration within the same Region, which does not provide disaster recovery across Regions.

Answer

Use S3 Cross-Region Replication for application data and launch EC2 instances from AMIs copied to the secondary Region

Answer

Take hourly snapshots of EBS volumes and copy them to another Region; use AWS CloudFormation to launch instances from the snapshots

Answer

Use Amazon Aurora Global Database for the database and deploy EC2 instances with an Application Load Balancer that has cross-Region load balancing enabled

Answer

Configure an Active-Passive failover using Route 53 with health checks within the same Region

Question 13

A company is designing a serverless data processing pipeline using AWS Lambda. The pipeline processes data from an Amazon Kinesis Data Stream. The Lambda function has a memory limit of 512 MB and a timeout of 5 minutes. The data volume is expected to increase significantly. Which TWO strategies should the company implement to improve throughput and reduce processing latency? (Choose TWO.)

Accepted Answer

Increase the number of shards in the Kinesis data stream. Increasing the number of shards in the Kinesis data stream (Option A) increases parallelism because each shard can be processed by one concurrent Lambda instance, allowing the pipeline to handle higher data volumes. Increasing the batch size in the event source mapping (Option B) allows each Lambda invocation to process more records at once, reducing the number of invocations and lowering per-record overhead. Together, these two strategies directly improve throughput and reduce latency. Option D (increasing memory) can improve performance for compute-bound functions but does not directly address parallelism or batching, and is not one of the two best choices for this scenario.

Answer

Change the data source from Kinesis to an Amazon SQS queue

Answer

Increase the Lambda function memory to 1024 MB

Answer

Increase the Lambda function's reserved concurrency to a higher value

Question 14

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager stores secrets with automatic rotation. AWS Systems Manager Parameter Store stores configuration data and secrets. AWS AppConfig manages application configuration. Option D (DynamoDB) is a database, not a configuration store. Option E (S3) can store config files but is not as integrated for secrets.

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 15

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. The platform must process and store high-velocity data with low latency. Which TWO AWS services should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is correct because it is designed to ingest and store high-velocity data streams from thousands of IoT devices with low latency, providing durable, ordered data that can be consumed in real time. Amazon Kinesis Data Analytics is correct because it can process streaming data from Kinesis Data Streams using SQL or Apache Flink to perform real-time analytics without needing to store the data first, meeting the low-latency processing requirement.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon SQS