SAP-C02 Design for New Solutions Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. A solutions architect has attached this key policy to an AWS KMS key. The IAM role MyAppRole is used by an application running on an EC2 instance in us-east-1. The application tries to decrypt an object stored in the S3 bucket my-bucket using server-side encryption with AWS KMS (SSE-KMS). What will happen?

Accepted Answer

The decryption fails if the application calls KMS Decrypt directly instead of letting S3 decrypt.. Option C is correct. The policy allows kms:Decrypt only when the request comes via S3 service (kms:ViaService) and when the encryption context matches the bucket ARN. If the application is using the AWS SDK to directly call KMS Decrypt (instead of letting S3 handle it), the condition kms:ViaService will not be satisfied, and the request will be denied. Option A is incorrect because the condition restricts decryption to S3 service calls. Option B is incorrect because the encryption context also must match. Option D is incorrect because the policy is attached to the key, not to the role; it's a key policy.

Answer

The decryption fails because the key policy does not grant decrypt to the role.

Answer

The decryption succeeds because the role has permissions via this key policy.

Answer

The decryption succeeds only if the object was uploaded with the correct encryption context.

Question 2

A company wants to migrate an on-premises relational database to Amazon RDS for MySQL with minimal downtime. The database is 500 GB in size. Which AWS service should be used for the initial data load and ongoing replication?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication.. Option B is correct. AWS Database Migration Service (DMS) can perform a full load and then ongoing replication using change data capture (CDC) to minimize downtime. Option A is incorrect because RDS does not support native replication from on-premises. Option C is incorrect because S3 is for storage, not database migration. Option D is incorrect because Snowball is for offline data transfer, not ongoing replication.

Answer

Use AWS Snowball to transfer the database files to RDS.

Answer

Use an RDS read replica from the on-premises database.

Answer

Export the database to Amazon S3 and import into RDS.

Question 3

A company is designing a new application that will be deployed on Amazon EKS. The application must meet PCI DSS compliance requirements. Which TWO steps should the solutions architect take to secure the cluster?

Accepted Answer

Configure IAM roles and RBAC policies to limit access.. Options B and C are correct. Enabling encryption for Kubernetes secrets using AWS KMS is a PCI DSS requirement. Restricting access to the cluster with IAM and RBAC is also required. Option A is not required for PCI DSS; cluster logging is optional. Option D is incorrect because Calico is a network policy, but not a PCI-specific requirement. Option E is incorrect because Bottlerocket is an OS, not a security control.

Answer

Enable AWS CloudTrail logging for the EKS cluster.

Answer

Install Calico for network policy enforcement.

Answer

Use Bottlerocket as the node operating system.

Question 4

A company is designing a multi-region disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon Aurora MySQL database. The RTO is 15 minutes and RPO is 1 minute. Which THREE steps should the solutions architect take to meet these requirements?

Accepted Answer

Pre-provision EC2 instances in the DR region with the application code and configuration.. Options B, D, and E are correct. Aurora Global Database provides replication with RPO of seconds and failover in minutes. Pre-provisioning standby instances in the DR region ensures capacity. Using Route 53 health checks with failover routing allows automatic DNS failover. Option A is incorrect because restoring from snapshots takes longer than 15 minutes. Option C is incorrect because cross-region read replicas do not automatically failover; manual promotion required.

Answer

Configure a cross-region read replica in the DR region and promote it during failover.

Answer

Take frequent snapshots of the Aurora cluster and copy them to the DR region.

Question 5

A company is building a serverless data processing pipeline using AWS Lambda, Amazon DynamoDB, and Amazon S3. The pipeline processes JSON files uploaded to an S3 bucket, transforms the data, and writes results to DynamoDB. The company wants to ensure the pipeline can handle bursts of traffic without data loss. Which TWO design decisions should the solutions architect make?

Accepted Answer

Configure DynamoDB with on-demand capacity mode.. Options A and C are correct. Using an SQS queue between S3 and Lambda decouples the processing and provides a buffer to handle bursts. Configuring DynamoDB with on-demand capacity handles sudden increases in writes without throttling. Option B is incorrect because Lambda function timeout does not prevent data loss; it only limits execution time. Option D is incorrect because DynamoDB Streams are for change capture, not for handling bursts. Option E is incorrect because S3 Transfer Acceleration is for faster uploads, not for burst handling.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Use DynamoDB Streams to capture changes and process in batches.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 6

A company runs a high-traffic e-commerce platform on AWS. The application consists of a web tier, an application tier, and a database tier using Amazon RDS for PostgreSQL with Multi-AZ. During a recent sales event, the database experienced high CPU utilization and read replicas were added to offload read traffic. However, the application team noticed that some product detail pages were showing stale data (prices and inventory levels) even though the primary database had the correct data. The application uses read replicas for read queries. The solutions architect investigated and found that the read replica lag was minimal (under 1 second). The application uses Django ORM with default transaction isolation. What is the most likely cause of the stale data?

Accepted Answer

The application is reading from read replicas, which are eventually consistent, and the data may be stale if the replica has not yet applied changes from the primary.. Option C is correct. The issue is that the application is reading from read replicas, which are eventually consistent. Even with minimal lag, there is a chance of reading stale data after a write to the primary. The application should read from the primary for critical data like prices and inventory. Option A is incorrect because Multi-AZ failover is for high availability, not read consistency. Option B is incorrect because Aurora I/O-Optimized is not applicable here (they are using RDS PostgreSQL). Option D is incorrect because increasing instance size would reduce CPU but not solve stale reads.

Answer

The Multi-AZ standby was promoted due to a failover, causing a brief inconsistency.

Answer

The application is not using a connection pool, causing connections to be established to different replicas.

Answer

The read replica is using a different storage type (Aurora I/O-Optimized) than the primary.

Question 7

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function that transcodes the video into multiple formats using FFmpeg. The transcoding job runs on the Lambda function with a 15-minute timeout. Recently, the company started receiving 4K videos that take more than 15 minutes to transcode. The Lambda function times out, and the video is not processed. The company wants to process these large videos without increasing the Lambda timeout and without rewriting the entire pipeline. What should the solutions architect do?

Accepted Answer

Replace the Lambda function with AWS Elemental MediaConvert job triggered by S3 events.. Option A is correct. AWS Elemental MediaConvert is a managed service designed for video transcoding. It can handle large files and long-running jobs. The pipeline can be modified to trigger a MediaConvert job instead of a Lambda function. Option B is incorrect because Lambda functions have a maximum execution time of 15 minutes; increasing memory does not extend timeout. Option C is incorrect because using a larger Lambda function still has the 15-minute limit. Option D is incorrect because Step Functions orchestrate Lambda functions but do not extend the individual Lambda timeout.

Answer

Increase the Lambda function memory to the maximum to improve performance and reduce processing time.

Answer

Use AWS Step Functions to call multiple Lambda functions in parallel to process chunks of the video.

Answer

Use a Lambda function with a larger ephemeral storage to handle the video file.

Question 8

A financial services company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed across multiple Availability Zones. The company recently experienced a DDoS attack that overwhelmed the ALB and caused downtime. The security team wants to implement a solution that can absorb DDoS attacks at the edge and only forward legitimate traffic to the ALB. Additionally, the company needs to protect sensitive data in transit using TLS 1.3. What should the solutions architect do?

Accepted Answer

Deploy Amazon CloudFront in front of the ALB with AWS Shield Advanced and enforce TLS 1.3.. Option C is correct. AWS Shield Advanced provides DDoS protection and can be combined with CloudFront or Global Accelerator. Using CloudFront with Shield Advanced provides edge protection and can enforce TLS 1.3. Option A is incorrect because Shield Standard is free but provides limited protection; it may not be sufficient. Option B is incorrect because NACLs are not effective against DDoS attacks at the edge. Option D is incorrect because WAF is for web application filtering, not for absorbing DDoS traffic at the edge.

Answer

Use AWS WAF with rate-based rules and associate it with the ALB.

Answer

Use an AWS Network Firewall and configure stateful rules to block malicious IPs.

Answer

Enable AWS Shield Standard and use security groups to restrict traffic.

Question 9

A company is designing a serverless application using AWS Lambda and Amazon API Gateway. The application must handle sudden spikes in traffic and ensure that no requests are lost. Which of the following design choices will BEST meet these requirements?

Accepted Answer

Configure API Gateway with a usage plan and throttling, and set Lambda reserved concurrency to limit the function's maximum capacity.. Option B is correct because configuring API Gateway with usage plans and throttling prevents overwhelming the backend, while Lambda reserved concurrency ensures a minimum capacity for the function. Option A is wrong because Lambda provisioned concurrency adds cost and is for reducing cold starts, not for handling spikes without loss. Option C is wrong because SQS decouples but does not prevent loss if Lambda doesn't scale. Option D is wrong because Step Functions add orchestration overhead and complexity.

Answer

Use Lambda provisioned concurrency to pre-warm the function and reduce cold starts.

Answer

Use AWS Step Functions to orchestrate the Lambda invocations and implement retry logic.

Answer

Use Amazon SQS to buffer requests and have Lambda poll the queue at a fixed rate.

Question 10

A healthcare company is storing sensitive patient data in Amazon S3. The compliance team requires that all data be encrypted at rest and that the encryption keys be rotated every 90 days. Additionally, the company must maintain an audit trail of all key usage. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) and enable automatic key rotation every 90 days. Enable AWS CloudTrail for KMS key usage logging.. Option D is correct because AWS KMS automatic key rotation handles rotation every 365 days (configurable to 90 days for custom key stores) and CloudTrail logs key usage. Option A is wrong because SSE-S3 does not provide key rotation control. Option B is wrong because SSE-C requires manual key management and rotation. Option C is wrong because client-side encryption places the burden on the application.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C) and implement a Lambda function to rotate keys every 90 days.

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable S3 server access logs.

Answer

Use client-side encryption with the AWS Encryption SDK and store the keys in AWS Secrets Manager with automatic rotation.

Question 11

A startup is deploying a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon DynamoDB table. To improve performance, the team wants to reduce latency for read-heavy workloads. Which design change would be MOST effective?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the session table.. Option C is correct because DynamoDB Accelerator (DAX) is an in-memory cache designed specifically for DynamoDB, reducing read latency. Option A is wrong because ElastiCache would require additional application code changes to integrate. Option B is wrong because increasing instance size is a generic scaling solution, not optimizing read latency. Option D is wrong because Auto Scaling does not reduce latency for individual requests.

Answer

Add an Amazon ElastiCache Redis cluster in front of DynamoDB to cache session data.

Answer

Use an Auto Scaling group to add more EC2 instances during peak hours.

Answer

Increase the size of the EC2 instances to handle more concurrent users.

Question 12

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application currently uses a central MySQL database. The architects plan to refactor the database into separate RDS instances per microservice. Which strategy will ensure data consistency across services with minimal application changes?

Accepted Answer

Implement a saga pattern using choreography, where each service publishes events and reacts to events from other services.. Option A is correct because the Saga pattern with choreography coordinates transactions across services without a central coordinator. Option B is wrong because two-phase commit (XA) is not natively supported by RDS and adds complexity. Option C is wrong because eventually consistent reads do not guarantee consistency. Option D is wrong because STRICT_TRANS_TABLES is a SQL mode, not a consistency solution.

Answer

Enable the STRICT_TRANS_TABLES SQL mode on all RDS instances to enforce data integrity.

Answer

Configure RDS read replicas for each service to ensure eventually consistent reads.

Answer

Use distributed transactions with a two-phase commit protocol across RDS instances.

Question 13

A media company is designing a video transcoding pipeline using AWS Lambda and Amazon S3. The pipeline must process videos uploaded to an S3 bucket, transcode them into multiple formats, and store the results in another S3 bucket. The processing time for each video can vary from a few seconds to several minutes. Which architecture will minimize cost and ensure all videos are processed, even if Lambda execution timeout is reached?

Accepted Answer

Configure S3 event notifications to send messages to an Amazon SQS queue. Have Lambda poll the queue and process each message. Set the SQS visibility timeout to match the expected maximum processing time.. Option B is correct because S3 event notifications to SQS, with Lambda polling the queue, decouples the process and allows Lambda to process messages at its own pace; if a timeout occurs, the message becomes visible again after the visibility timeout. Option A is wrong because direct Lambda invocation via S3 events can cause concurrent invocations to be throttled; DLQ alone does not handle timeouts. Option C is wrong because Step Functions adds cost and complexity. Option D is wrong because Kinesis is overkill and streaming is not needed.

Answer

Configure S3 event notifications to invoke Lambda directly and use a dead-letter queue to capture failed events.

Answer

Use AWS Step Functions to orchestrate the transcoding workflow, with each step as a separate Lambda function.

Answer

Use Amazon Kinesis Data Streams to ingest S3 events and have Lambda process records from the stream.

Question 14

A company is designing a new web application that will be accessed by users globally. The application uses Amazon CloudFront as a CDN and stores static content in Amazon S3. The dynamic content is served from EC2 instances in a single AWS Region. Which of the following will improve performance for users in distant regions with the LEAST operational effort?

Accepted Answer

Use AWS Global Accelerator to route traffic to the EC2 instances via the AWS global network.. Option A is correct because AWS Global Accelerator improves performance by routing traffic over the AWS global network to the optimal endpoint. Option B is wrong because Lambda@Edge runs at edge locations but is for lightweight compute, not for dynamic content hosting. Option C is wrong because multi-Region deployment adds significant operational complexity. Option D is wrong because ElastiCache caches data but does not reduce network latency for distant users.

Answer

Deploy EC2 instances in multiple AWS Regions and use Route 53 latency-based routing.

Answer

Move the dynamic content to Lambda@Edge functions running at CloudFront edge locations.

Answer

Add an Amazon ElastiCache cluster in front of the EC2 instances to cache dynamic responses.

Question 15

A company is building a data lake on Amazon S3 using Parquet files. The data will be queried by multiple teams using Amazon Athena. The security team requires that access to sensitive columns (e.g., PII) be restricted based on the user's role. Which solution provides column-level access control with the LEAST administrative overhead?

Accepted Answer

Use AWS Lake Formation to define column-level permissions in the Data Catalog.. Option C is correct because Lake Formation allows column-level permissions via the Data Catalog. Option A is wrong because S3 bucket policies are at the object level, not column level. Option B is wrong because IAM policies can restrict actions but not columns. Option D is wrong because Redshift Spectrum queries through Redshift but adds complexity.

Answer

Create separate S3 buckets for sensitive and non-sensitive data and apply bucket policies to restrict access.

Answer

Load the data into Amazon Redshift and use Redshift Spectrum to query S3, then apply column-level security through Redshift.

Answer

Use IAM policies with condition keys to restrict access based on the Athena workgroup.

SAP-C02 Design for New Solutions Practice Test 16 — 15 Questions

Exhibit

SAP-C02 Design for New Solutions Practice Test 16 — 15 Questions

Exhibit