SAP-C02 Design for New Solutions Practice Test 17 — 15 Questions

Question 1

A data analytics company is building a real-time streaming pipeline using Amazon Kinesis Data Streams. The data is consumed by multiple consumer applications, each with different processing requirements. The company wants to ensure that each consumer can process records independently without affecting others and can reprocess data from a specific point in time. Which feature should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Enhanced Fan-Out with a timestamp to start reading.. Enhanced Fan-Out (EFO) provides each consumer with a dedicated 2 MB/second read throughput per shard, ensuring independent processing without contention. By using the SubscribeToShard API with a starting position specified via a timestamp, consumers can reprocess data from a specific point in time, meeting the requirement exactly.

Answer

Increase the data retention period to 365 days.

Answer

Use resharding to increase the number of shards.

Answer

Use the Kinesis Client Library (KCL) with checkpointing.

Question 2

Refer to the exhibit. A solutions architect has attached this IAM policy to an IAM role used by an application. The application is trying to upload an object to the S3 bucket example-bucket with server-side encryption using AWS KMS (SSE-KMS). What will happen?

Accepted Answer

The upload fails because the policy requires SSE-S3.. The IAM policy explicitly requires the `s3:x-amz-server-side-encryption` header to be set to `AES256` (SSE-S3) via the `StringEquals` condition. Since the application is attempting to use SSE-KMS, the encryption header will be `aws:kms`, which does not match the required value. Therefore, the condition fails, and the `s3:PutObject` action is denied, causing the upload to fail.

Answer

The upload succeeds because the policy allows s3:PutObject for the bucket.

Answer

The upload fails because the bucket policy does not allow SSE-KMS.

Answer

The upload succeeds because the condition only applies to encryption at rest.

Question 3

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to store session state data that must be highly available and low latency. The data is accessed frequently and can be recreated if lost. Which storage solution should the solutions architect recommend?

Accepted Answer

Store session state in Amazon ElastiCache for Redis.. Amazon ElastiCache for Redis is the ideal choice for storing session state data in a containerized ECS with Fargate environment because it provides in-memory caching with sub-millisecond latency, high availability through replication and automatic failover, and supports data persistence. Since the session data can be recreated if lost, the ephemeral nature of Redis is acceptable, and its low-latency access pattern perfectly matches the frequent read/write requirements of session state.

Answer

Store session state in Amazon DynamoDB.

Answer

Store session state in Amazon S3.

Answer

Store session state in Amazon EFS.

Question 4

A company is designing a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The Lambda function sometimes experiences throttling, causing messages to be sent to the dead-letter queue (DLQ). The company wants to minimize throttling and ensure that messages are processed in order. What should the solutions architect do?

Accepted Answer

Use a FIFO SQS queue and configure the Lambda function with reserved concurrency.. Using an SQS FIFO queue guarantees strict message ordering, and reserved concurrency on the Lambda function prevents throttling by allocating a fixed number of concurrent executions exclusively for this function. This combination ensures messages are processed in order without being throttled, avoiding unnecessary DLQ deliveries.

Answer

Use a standard SQS queue and configure a Lambda function with a higher concurrency limit.

Answer

Use an SQS FIFO queue with provisioned concurrency on the Lambda function.

Answer

Increase the batch size in the Lambda event source mapping and use a standard queue.

Question 5

A company is hosting a static website on Amazon S3. The website uses JavaScript to make API calls to a backend API hosted on Amazon API Gateway. The company wants to reduce latency for users worldwide. Which combination of AWS services should the solutions architect use? (Choose two.)

Accepted Answer

Use CloudFront with API Gateway as an origin.. Amazon CloudFront can use API Gateway as a custom origin, allowing API requests to be served from edge locations closer to users, which reduces latency. This integration caches API responses at the edge when possible and terminates the user's TCP connection at the edge, improving performance for global users.

Answer

Use AWS Global Accelerator for the S3 website.

Answer

Use Lambda@Edge to process API calls at the edge.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 6

A company is running a stateful web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the instance. The company wants to make the application highly available and fault-tolerant without rewriting the application code. What should the solutions architect do?

Accepted Answer

Configure the ALB with sticky sessions (session affinity) and use a custom cookie.. Configuring the ALB with sticky sessions (session affinity) using a custom cookie allows the ALB to consistently route requests from a user's session to the same EC2 instance, preserving the locally stored session state without requiring any application code changes. This approach leverages the ALB's built-in session affinity feature, which is transparent to the application and ensures high availability by distributing traffic across healthy instances while maintaining session continuity.

Answer

Replace the ALB with a Network Load Balancer (NLB) and enable cross-zone load balancing.

Answer

Move session state to Amazon ElastiCache and configure the ALB to use sticky sessions.

Answer

Use an Auto Scaling group to add more instances and distribute load.

Question 7

Refer to the exhibit. A solutions architect has attached this key policy to an AWS KMS key. The IAM role MyAppRole is used by an application running on an EC2 instance in us-east-1. The application tries to decrypt an object stored in the S3 bucket my-bucket using server-side encryption with AWS KMS (SSE-KMS). What will happen?

Accepted Answer

The decryption fails if the application calls KMS Decrypt directly instead of letting S3 decrypt.. The key policy includes a condition that limits the `kms:Decrypt` permission to only be allowed when the request comes from Amazon S3 (using `kms:ViaService`). When the application calls KMS Decrypt directly, the request does not come from S3, so the condition is not satisfied, and the decryption fails. The IAM role MyAppRole does not have an IAM policy granting `kms:Decrypt`, and the key policy does not grant it directly to the role. Options A, B, and D are incorrect because the decryption fails only when calling KMS directly, not because of the role's permissions or encryption context.

Answer

The decryption fails because the key policy does not grant decrypt to the role.

Answer

The decryption succeeds because the role has permissions via this key policy.

Answer

The decryption succeeds only if the object was uploaded with the correct encryption context.

Question 8

A company wants to migrate an on-premises relational database to Amazon RDS for MySQL with minimal downtime. The database is 500 GB in size. Which AWS service should be used for the initial data load and ongoing replication?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication.. AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports both a full load of the 500 GB database and continuous change data capture (CDC) using the MySQL binary log (binlog) to replicate ongoing changes with minimal downtime. DMS can perform the initial load while the source remains operational, then switch to CDC to keep the target in sync until cutover.

Answer

Use AWS Snowball to transfer the database files to RDS.

Answer

Use an RDS read replica from the on-premises database.

Answer

Export the database to Amazon S3 and import into RDS.

Question 9

A company is designing a new application that will be deployed on Amazon EKS. The application must meet PCI DSS compliance requirements. Which TWO steps should the solutions architect take to secure the cluster?

Accepted Answer

Configure IAM roles and RBAC policies to limit access.. PCI DSS Requirement 7 mandates strict access controls. In Amazon EKS, combining IAM roles for cluster-level authentication with Kubernetes RBAC for namespace-level authorization ensures least-privilege access, which is a core compliance requirement. This dual-layer approach prevents unauthorized API calls and pod-level actions.

Answer

Enable AWS CloudTrail logging for the EKS cluster.

Answer

Install Calico for network policy enforcement.

Answer

Use Bottlerocket as the node operating system.

Question 10

A company is designing a multi-region disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon Aurora MySQL database. The RTO is 15 minutes and RPO is 1 minute. Which THREE steps should the solutions architect take to meet these requirements?

Accepted Answer

Pre-provision EC2 instances in the DR region with the application code and configuration.. Pre-provisioning EC2 instances in the DR region with the application code and configuration ensures that compute capacity is ready to serve traffic immediately upon failover. This eliminates the time needed to launch and configure instances, which is critical for meeting the 15-minute RTO. Without pre-provisioning, the time to spin up and configure instances would likely exceed the RTO.

Answer

Configure a cross-region read replica in the DR region and promote it during failover.

Answer

Take frequent snapshots of the Aurora cluster and copy them to the DR region.

Question 11

A company is building a serverless data processing pipeline using AWS Lambda, Amazon DynamoDB, and Amazon S3. The pipeline processes JSON files uploaded to an S3 bucket, transforms the data, and writes results to DynamoDB. The company wants to ensure the pipeline can handle bursts of traffic without data loss. Which TWO design decisions should the solutions architect make?

Accepted Answer

Configure DynamoDB with on-demand capacity mode.. DynamoDB on-demand capacity mode (Option A) automatically scales read/write throughput to handle traffic spikes without requiring capacity planning or risking throttling. This is essential for a serverless pipeline that experiences bursts of traffic, as it prevents data loss by ensuring writes always succeed without ProvisionedThroughputExceededException errors.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Use DynamoDB Streams to capture changes and process in batches.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 12

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function that transcodes the video into multiple formats using FFmpeg. The transcoding job runs on the Lambda function with a 15-minute timeout. Recently, the company started receiving 4K videos that take more than 15 minutes to transcode. The Lambda function times out, and the video is not processed. The company wants to process these large videos without increasing the Lambda timeout and without rewriting the entire pipeline. What should the solutions architect do?

Accepted Answer

Replace the Lambda function with AWS Elemental MediaConvert job triggered by S3 events.. AWS Elemental MediaConvert is a managed service designed for video transcoding. It can handle large files and long-running jobs. The pipeline can be modified to trigger a MediaConvert job instead of a Lambda function. Option B is incorrect because Lambda functions have a maximum execution time of 15 minutes; increasing memory does not extend timeout. Option C is incorrect because using a larger Lambda function still has the 15-minute limit. Option D is incorrect because Step Functions orchestrate Lambda functions but do not extend the individual Lambda timeout.

Answer

Increase the Lambda function memory to the maximum to improve performance and reduce processing time.

Answer

Use AWS Step Functions to call multiple Lambda functions in parallel to process chunks of the video.

Answer

Use a Lambda function with a larger ephemeral storage to handle the video file.

Question 13

A financial services company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed across multiple Availability Zones. The company recently experienced a DDoS attack that overwhelmed the ALB and caused downtime. The security team wants to implement a solution that can absorb DDoS attacks at the edge and only forward legitimate traffic to the ALB. Additionally, the company needs to protect sensitive data in transit using TLS 1.3. What should the solutions architect do?

Accepted Answer

Deploy Amazon CloudFront in front of the ALB with AWS Shield Advanced and enforce TLS 1.3.. Deploying CloudFront in front of the ALB with AWS Shield Advanced provides edge-based DDoS protection, absorbing attacks before they reach the ALB. CloudFront supports TLS 1.3, meeting the encryption requirement. Option B is incorrect because AWS WAF with rate-based rules can help filter malicious traffic but does not absorb DDoS attacks at the edge; it works at the ALB level. Option C is incorrect because AWS Network Firewall is a stateful firewall that protects VPCs, not at the edge, and cannot absorb large DDoS attacks. Option D is incorrect because AWS Shield Standard provides basic protection, but it is not sufficient for absorbing DDoS attacks, and security groups do not mitigate DDoS at the edge.

Answer

Use AWS WAF with rate-based rules and associate it with the ALB.

Answer

Use an AWS Network Firewall and configure stateful rules to block malicious IPs.

Answer

Enable AWS Shield Standard and use security groups to restrict traffic.

Question 14

A company is designing a serverless application using AWS Lambda and Amazon API Gateway. The application must handle sudden spikes in traffic and ensure that no requests are lost. Which of the following design choices will BEST meet these requirements?

Accepted Answer

Configure API Gateway with a usage plan and throttling, and set Lambda reserved concurrency to limit the function's maximum capacity.. Configuring API Gateway with usage plans and throttling prevents overwhelming the backend, while Lambda reserved concurrency ensures a minimum capacity for the function. Option A is wrong because Lambda provisioned concurrency adds cost and is for reducing cold starts, not for handling spikes without loss. Option C is wrong because Step Functions add orchestration overhead and complexity, and while they can implement retry logic, they do not directly prevent request loss during sudden traffic spikes. Option D is wrong because SQS buffers requests but does not prevent loss if the Lambda function fails to scale and process messages fast enough; it relies on the Lambda scaling and may still result in throttling if the queue grows too large.

Answer

Use Lambda provisioned concurrency to pre-warm the function and reduce cold starts.

Answer

Use AWS Step Functions to orchestrate the Lambda invocations and implement retry logic.

Answer

Use Amazon SQS to buffer requests and have Lambda poll the queue at a fixed rate.

Question 15

A healthcare company is storing sensitive patient data in Amazon S3. The compliance team requires that all data be encrypted at rest and that the encryption keys be rotated every 90 days. Additionally, the company must maintain an audit trail of all key usage. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use client-side encryption with the AWS Encryption SDK and store the keys in AWS Secrets Manager with automatic rotation.. Meets all requirements with the least operational overhead. Client-side encryption with the AWS Encryption SDK ensures data is encrypted at rest. Keys are stored in AWS Secrets Manager, which supports automatic rotation on a custom 90-day schedule. CloudTrail logs all Secrets Manager API calls, providing an audit trail of key usage. Option A requires custom Lambda code for rotation. Option B uses SSE-S3, which cannot be rotated on a 90-day schedule and lacks key usage audit. Option C uses SSE-KMS, but automatic rotation for customer managed keys is fixed at 365 days, failing the 90-day requirement.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C) and implement a Lambda function to rotate keys every 90 days.

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable S3 server access logs.

Answer

Use S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) and enable automatic key rotation every 90 days. Enable AWS CloudTrail for KMS key usage logging.