SAP-C02 Design for New Solutions Practice Test 16 — 15 Questions

Question 1

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to minimize operational overhead and ensure that service discovery is automatically updated when services scale. Which service discovery option should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Cloud Map. AWS Cloud Map provides service discovery that automatically updates with service scaling.

Answer

Amazon ECS service connect

Answer

Elastic Load Balancing with internal NLB

Answer

Amazon Route 53 private hosted zones with health checks

Question 2

A company is designing a new application that will run on Amazon EKS. The application must be able to scale based on custom metrics such as number of messages in an SQS queue. Which Kubernetes component should be used to achieve this?

Accepted Answer

Kubernetes Event-Driven Autoscaler (KEDA). Kubernetes Event-Driven Autoscaler (KEDA) is the correct component because it is specifically designed to scale Kubernetes workloads based on external event sources like Amazon SQS queue depth. KEDA acts as a custom metrics adapter that integrates with the Kubernetes Horizontal Pod Autoscaler (HPA), allowing the application to scale pods dynamically based on the number of messages in the SQS queue, which is a custom metric not natively supported by the standard HPA.

Answer

Kubernetes Horizontal Pod Autoscaler (HPA) with Prometheus

Answer

Kubernetes Cluster Autoscaler

Answer

AWS Auto Scaling with target tracking

Question 3

A company is designing a new data lake on Amazon S3. The data must be encrypted at rest using envelope encryption with AWS KMS. The company wants to use an AWS managed key that rotates annually. Which TWO components are required for this design? (Choose TWO.)

Accepted Answer

AWS KMS data key. Option A (AWS KMS data key) is correct because envelope encryption requires generating a unique data key from KMS to encrypt the actual data; the plaintext data key encrypts the objects while the encrypted copy of the data key is stored alongside the data. Option E (Amazon S3 bucket with SSE-KMS enabled) is correct because SSE-KMS is the S3 server-side encryption mode that integrates with AWS KMS to perform envelope encryption automatically, using KMS keys to protect the data keys. Option B is not required because the scenario specifies an AWS managed key (aws/s3), not a customer managed key, and AWS managed keys rotate annually by default. Option C is incorrect because AWS Certificate Manager manages TLS/SSL certificates for data in transit, not encryption at rest. Option D is incorrect because AWS CloudHSM is a dedicated hardware security module service and is not needed when using AWS KMS managed keys for S3 envelope encryption.

Answer

AWS KMS customer managed key

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 4

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS database. Which THREE steps are required to secure the database access? (Choose THREE.)

Accepted Answer

Place the Lambda function in a VPC with access to the RDS instance. Placing the Lambda function in the same VPC as the RDS instance allows it to communicate over a private IP address, eliminating exposure to the public internet. This is essential for secure database access, as Lambda functions outside the VPC cannot directly connect to RDS instances that are not publicly accessible.

Answer

Store database credentials in the Lambda function code

Answer

Use a public IP address for the RDS instance

Question 5

A company has attached the following IAM policy to an IAM role used by an EC2 instance:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/16"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "Null": {
          "aws:SourceVpce": "true"
        }
      }
    }
  ]
}

The EC2 instance is in a VPC with CIDR 10.0.0.0/16 and has a public IP. Which of the following statements is true regarding access to the S3 bucket?

Accepted Answer

The EC2 instance can perform GetObject and PutObject operations only if it uses a VPC endpoint. The IAM policy has an explicit Deny for s3:* when aws:SourceVpce is null (i.e., when the request does not come through a VPC endpoint). Because the EC2 instance has a public IP and the policy allows only from 10.0.0.0/16, the Allow statement would match if the source IP is in that range, but the Deny statement overrides any Allow when the request does not use a VPC endpoint. Therefore, the instance can only perform GetObject and PutObject if it uses a VPC endpoint.

Answer

The EC2 instance can perform GetObject and PutObject operations if it uses HTTPS

Answer

The EC2 instance cannot perform any S3 operations because the Deny statement blocks all requests

Answer

The EC2 instance can perform GetObject and PutObject operations from within the VPC

Question 6

A company is monitoring a Lambda function named my-function. The function has an alias 'prod' that points to version 1. The above CLI output shows two metrics for the Errors metric. What is the likely reason for two metrics?

Accepted Answer

The function has two versions: $LATEST and version 1. The CLI output shows two metrics for the Errors metric because the function has two versions: $LATEST (the unpublished, mutable version) and version 1 (the published, immutable version). The alias 'prod' points to version 1, but CloudWatch metrics are emitted per version, so both $LATEST and version 1 generate separate error metric streams. This is why two distinct data points appear for the same metric name.

Answer

The function is invoked via two different triggers

Answer

The function is configured with two different reserved concurrency settings

Answer

The function is deployed in two different regions

Question 7

A company is designing a new real-time analytics platform that ingests millions of events per second from IoT devices. The events must be processed with low latency (under 100 ms) and stored for replay. The company wants to use managed services. Which combination of AWS services should the company use?

Accepted Answer

Amazon Kinesis Data Streams + AWS Lambda. Amazon Kinesis Data Streams can ingest and buffer millions of events per second with sub-100 ms latency, and AWS Lambda can process each record in near real-time as it arrives in the stream. This combination meets the low-latency requirement and allows events to be replayed from the stream's retention window (up to 365 days with extended retention).

Answer

Amazon S3 + AWS Lambda

Answer

Amazon Kinesis Data Firehose + Amazon Redshift

Answer

Amazon SQS + AWS Lambda

Question 8

A company is designing a multi-region active-active application with a relational database. The application requires strong consistency and read-after-write consistency globally. Which AWS database service should the company choose?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is the only AWS relational database service that can span multiple regions while providing strong consistency within each region. Although it is technically active-passive (single primary writer), it can be used in an active-active pattern for reads by leveraging read replicas in secondary regions. For writes, applications can use write forwarding to send writes from any region to the primary, ensuring strong consistency. DynamoDB Global Tables is NoSQL and provides eventual consistency, not strong. RDS Multi-AZ is single-region. ElastiCache is a cache, not a relational database. Thus, Aurora Global Database best meets the requirements despite its limitations.

Answer

Amazon RDS for MySQL with Multi-AZ

Answer

Amazon DynamoDB Global Tables

Answer

Amazon ElastiCache for Memcached

Question 9

A company is designing a new web application that will be accessed by users worldwide. The application will serve static content (HTML, CSS, images) and dynamic API responses. The company wants to minimize latency for all users. Which combination of AWS services should the company use?

Accepted Answer

Amazon CloudFront and Amazon API Gateway. Amazon CloudFront is a global content delivery network (CDN) that serves static content (HTML, CSS, images) from edge locations, minimizing latency. For dynamic API responses, CloudFront can route requests to Amazon API Gateway, which acts as a backend to handle API calls. This combination provides low-latency access worldwide for both static and dynamic content. Option A (Route 53 + S3) is incorrect because Route 53 is DNS only and S3 alone does not provide caching at edge locations. Option C (S3 + CloudFront) is missing a managed API service for dynamic responses; while CloudFront can serve static content from S3, it needs API Gateway or a compute origin for dynamic APIs. Option D (ALB + CloudFront) places CloudFront in front of an ALB, but ALB is regional and does not effectively reduce latency for static assets; additionally, ALB is not optimized for API management like API Gateway.

Answer

Amazon Route 53 and Amazon S3

Answer

Amazon S3 and Amazon CloudFront

Answer

Application Load Balancer (ALB) and Amazon CloudFront

Question 10

A company is designing a new data processing pipeline that uses AWS Glue to run ETL jobs. The pipeline must process data from multiple sources with varying schemas and load the results into Amazon Redshift. The data must be partitioned by date and encrypted at rest. Which TWO AWS services or features should the company use to meet these requirements? (Choose two.)

Accepted Answer

Amazon S3 server-side encryption. Option A (Amazon S3 server-side encryption) is correct because the ETL pipeline's source and intermediate data typically land in Amazon S3, and enabling SSE (SSE-S3, SSE-KMS, or SSE-C) satisfies the requirement that data be encrypted at rest. Option E (AWS Glue Data Catalog) is correct because it is the central, Hive-compatible metastore that stores table definitions, schemas, and partition metadata (including date-based partitions) so Glue ETL jobs and Redshift Spectrum/Redshift can resolve the varying schemas and partition pruning. Option B (AWS DMS) is not needed since the scenario uses Glue for ETL rather than continuous database replication. Option C (Kinesis Data Analytics) is for real-time stream processing with SQL/Flink, not batch ETL into Redshift. Option D (Athena) is an interactive query service over S3 and does not perform the ETL loading or partitioning required here.

Answer

AWS Database Migration Service (DMS)

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Athena

Question 11

A company is designing a new disaster recovery (DR) strategy for its critical applications. The DR plan must achieve a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 minute. The applications run on Amazon EC2 instances with Amazon EBS volumes. Which THREE actions should the company take to meet these requirements? (Choose three.)

Accepted Answer

Configure Amazon RDS Multi-AZ deployments.. Option A is correct because Amazon RDS Multi-AZ deployments maintain a synchronous standby replica in a different Availability Zone and automatically fail over in typically 60–120 seconds, which supports the 15-minute RTO and near-zero RPO for the database tier of the critical applications. Option C is correct because a Pilot Light strategy replicates data to a secondary region and keeps a minimal core of resources running, allowing the full environment to be scaled up quickly on failover, which can meet a 15-minute RTO while continuous replication supports a 1-minute RPO. Option E is correct because Amazon EBS cross-region snapshot copy replicates EBS volume data to another region, enabling recovery of EC2 instance volumes in the DR region with a low RPO and supporting the regional failover needed for the 15-minute RTO. Option B is incorrect because using a single Availability Zone increases risk and does not provide the resilience or fast failover required for a 15-minute RTO. Option D is incorrect because Amazon S3 Glacier is archival storage with retrieval times ranging from minutes to hours, so it cannot meet a 1-minute RPO or 15-minute RTO.

Answer

Use a single Availability Zone for EC2 instances to simplify failover.

Answer

Store backups in Amazon S3 Glacier.

Question 12

Refer to the exhibit. A company uses AWS CloudFormation to deploy an EC2 instance. The template uses a condition to select the instance type based on the environment. The company deploys the stack with the parameter EnvType set to 'prod'. What will be the instance type of the created EC2 instance?

Accepted Answer

t3.large. The condition in the CloudFormation template evaluates to true when EnvType equals 'prod', so the EC2 instance is created with the instance type specified in the condition's true branch, which is t3.large. The template uses a condition like 'If(Equals(EnvType, 'prod'), t3.large, t2.micro)', and since the parameter is set to 'prod', the Fn::If intrinsic function returns 't3.large'.

Answer

The instance type will be determined at runtime.

Answer

The instance will not be created because the condition is false.

Answer

t2.micro

Question 13

A company is designing a new container-based application using Amazon EKS. The application requires persistent storage for stateful workloads, such as databases. The storage must be highly available and durable across multiple Availability Zones. Which storage solution should be used?

Accepted Answer

Use Amazon EFS with the EFS CSI driver.. Amazon EFS provides a fully managed, elastic NFS file system that is accessible from multiple Amazon EKS worker nodes across different Availability Zones simultaneously. The EFS CSI driver enables Kubernetes pods to mount EFS as a persistent volume, delivering the required high availability and durability for stateful workloads like databases without single-AZ dependency.

Answer

Use Amazon EBS volumes with the EBS CSI driver.

Answer

Use Amazon FSx for Lustre as a shared file system.

Answer

Use Amazon S3 with the S3 CSI driver.

Question 14

A company is designing a new serverless application that processes orders from an e-commerce website. The application uses AWS Lambda functions that are invoked by Amazon API Gateway. The company expects a sudden spike in traffic during a flash sale. Which TWO strategies should be used to ensure the application can handle the spike without errors? (Choose two.)

Accepted Answer

Set Lambda reserved concurrency to a value that matches the expected peak load.. Lambda reserved concurrency guarantees a fixed number of concurrent executions for the function, preventing it from being throttled by other functions in the account. By setting reserved concurrency to match the expected peak load, the application ensures that all requests during the flash sale can be processed without hitting account-level concurrency limits.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Use Amazon SQS to buffer requests and decouple the frontend.

Answer

Configure Lambda provisioned concurrency to pre-warm instances.

Question 15

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The solution must have a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 5 minutes. The application data is stored on Amazon EBS volumes. Which THREE steps should be taken to meet these requirements? (Choose three.)

Accepted Answer

Create Amazon Machine Images (AMIs) with pre-installed software and use AWS Backup to automate recovery in another region.. Creating AMIs with pre-installed software and using AWS Backup to automate recovery in another region enables rapid instance launch with all required software already configured, supporting an RTO of under 15 minutes. AWS Backup can automate cross-region AMI copying and recovery, ensuring the RPO of less than 5 minutes is met when combined with frequent backup schedules.

Answer

Enable Amazon S3 cross-region replication for the EBS snapshots.

Answer

Use AWS Database Migration Service (DMS) to replicate data to a secondary region.