SAP-C02 Design for New Solutions Practice Test 17 — 15 Questions

Question 1

A financial services company is designing a multi-tier application that must achieve a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes for a database tier. The application uses Amazon RDS for MySQL with Multi-AZ deployment. Which disaster recovery strategy meets these requirements at the LOWEST cost?

Accepted Answer

Create a cross-Region read replica of the RDS MySQL instance in another Region. In a disaster, promote the read replica to a standalone instance.. Option D is correct because RDS Cross-Region Read Replicas provide asynchronous replication with RPO in seconds, and can be promoted to master in minutes, meeting RTO. Option A is wrong because Multi-AZ only protects against AZ failure, not Region failure. Option B is wrong because a manual snapshot and restore would take longer than 1 hour RTO. Option C is wrong because Aurora Global Database is more expensive than RDS read replicas.

Answer

Deploy the RDS instance in Multi-AZ configuration and take frequent snapshots to another Region.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to an RDS instance in another Region.

Answer

Use Amazon Aurora Global Database, which provides global replication with typical RPO of 1 second.

Question 2

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 100 Mbps internet connection. The migration must be completed within a week and have minimal downtime. Which AWS service should the company use to transfer the initial database dump to AWS?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to migrate the data with minimal downtime.. Option B is correct because AWS DMS can perform a live migration with minimal downtime by replicating ongoing changes. Option A is wrong because direct upload via internet would take too long given bandwidth. Option C is wrong because Snowball is for offline data transfer, but would not meet the time constraint if shipping takes days. Option D is wrong because S3 Transfer Acceleration speeds up uploads but still limited by internet bandwidth.

Answer

Upload the database dump directly to an S3 bucket using multipart upload.

Answer

Use AWS Snowball Edge to transfer the data offline.

Answer

Use S3 Transfer Acceleration to speed up the upload of the dump file.

Question 3

Which TWO actions will improve the security posture of an Amazon S3 bucket used to store sensitive data? (Choose two.)

Accepted Answer

Enable S3 Block Public Access settings at the account or bucket level.. Options B and D are correct. B: Enabling S3 Block Public Access prevents any public access to the bucket. D: Using bucket policies with condition keys such as aws:SourceIp restricts access to specific IP ranges. Option A is wrong because server access logs provide audit but do not improve security directly. Option C is wrong because encryption protects data at rest, not access control. Option E is wrong because versioning protects against accidental deletion but not unauthorized access.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable default encryption using SSE-S3.

Answer

Enable S3 server access logging for the bucket.

Question 4

A company is designing a high-performance computing (HPC) workload on AWS. The workload requires tightly coupled inter-node communication with low latency and high bandwidth. Which THREE services or features should the architect consider to meet these requirements? (Choose three.)

Accepted Answer

EC2 instances with enhanced networking and high-throughput (e.g., p4d, p3dn). Options A, C, and D are correct. A: Elastic Fabric Adapter (EFA) provides low-latency, high-bandwidth communication for HPC. C: Placement Groups with cluster placement ensure instances are physically close for low network latency. D: Instance types like p4d or p3dn with enhanced networking offer high throughput. Option B is wrong because AWS Global Accelerator is for internet-facing traffic, not inter-node communication. Option E is wrong because VPC peering is for connecting VPCs, not for intra-VPC communication performance.

Answer

VPC peering between multiple VPCs

Answer

AWS Global Accelerator

Question 5

Which TWO strategies can reduce the cost of storing infrequently accessed data in Amazon S3 while maintaining millisecond retrieval latency? (Choose two.)

Accepted Answer

Use S3 Standard-IA for data that is accessed less frequently but requires millisecond retrieval.. Options A and D are correct. A: S3 Intelligent-Tiering automatically moves data to lower-cost tiers when access patterns change, with no retrieval cost for infrequent access. D: S3 Standard-IA provides lower storage cost than Standard with the same latency. Option B is wrong because S3 One Zone-IA is less durable and not recommended for important data. Option C is wrong because S3 Glacier Deep Archive has retrieval times in hours, not milliseconds. Option E is wrong because S3 Glacier Flexible Retrieval has retrieval times in minutes to hours.

Answer

Transition objects to S3 Glacier Flexible Retrieval after 90 days.

Answer

Use S3 Glacier Deep Archive for data older than 30 days.

Answer

Use S3 One Zone-IA for all data to reduce storage costs.

Question 6

Which THREE design patterns can help a microservices application achieve loose coupling and independent deployability? (Choose three.)

Accepted Answer

Circuit breaker pattern to handle service failures. Options B, C, and D are correct. B: Event-driven communication via SNS/SQS decouples services. C: API Gateway provides a facade that routes to different services independently. D: Circuit breaker pattern prevents cascading failures, allowing independent failure handling. Option A is wrong because shared database creates tight coupling. Option E is wrong because synchronous HTTP calls create tight coupling.

Answer

Shared database schema across services

Answer

Synchronous RESTful HTTP calls between services

Question 7

A company runs a critical web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) with a target group that has health checks configured. Recently, the operations team noticed that during a deployment, the ALB started routing traffic to a new instance before it was ready to serve requests, causing a brief period of errors. The team wants to ensure that new instances are fully initialized and ready before receiving traffic. The application takes about 30 seconds to start up. Current health check settings: health check protocol HTTP, path /, interval 30 seconds, timeout 5 seconds, healthy threshold 2, unhealthy threshold 2. The deployment uses the Auto Scaling group's instance refresh feature. Which of the following is the MOST effective way to prevent traffic from being sent to instances that are not ready?

Accepted Answer

Implement a lifecycle hook in the Auto Scaling group that waits for the instance to signal readiness. Also, configure the target group health check with a longer interval and a higher healthy threshold to ensure the instance is fully operational.. Option B is correct because the lifecycle hook pauses the instance until it is ready, and the health check with a longer grace period ensures the ALB does not consider the instance healthy until it passes. Option A is wrong because increasing the interval does not prevent early traffic; the instance might still pass the first check before being ready. Option C is wrong because the warm-up time in instance refresh is for the Auto Scaling group to launch instances, not for the application to become ready. Option D is wrong because pre-warming is not a service; it's a manual process.

Answer

Increase the health check interval to 60 seconds and the healthy threshold to 5.

Answer

Use the Auto Scaling group's instance refresh feature with a warm-up time of 60 seconds.

Answer

Use AWS Global Accelerator to pre-warm the endpoints before directing traffic.

Question 8

A company is designing a data processing pipeline for real-time analytics. The pipeline ingests data from IoT devices that send JSON messages via MQTT to AWS IoT Core. The messages must be processed in real-time to detect anomalies and the results must be stored in Amazon S3 for later analysis. The company currently uses a Lambda function to process each message, but as the number of devices grows, the Lambda function is being throttled due to concurrency limits. The company needs a solution that scales to handle thousands of devices per second without losing messages. The processed data must be available in S3 within 1 minute of ingestion. Which architecture should the company use?

Accepted Answer

Use AWS IoT Core rules to route messages to Amazon Kinesis Data Firehose, which writes raw data to S3. Then use Amazon Kinesis Data Analytics to read from S3 and perform real-time anomaly detection, writing results back to S3 via Firehose.. Option C is correct because Kinesis Data Analytics provides real-time SQL processing, and Kinesis Data Firehose delivers the results to S3 with low latency. Option A is wrong because Lambda concurrency limits will still be hit; SQS does not solve concurrency limits. Option B is wrong because Kinesis Data Streams alone does not process data; Lambda would still be needed and could be throttled. Option D is wrong because S3 cannot process streaming data in real-time; S3 Select is for querying objects.

Answer

Send the IoT messages to an Amazon SQS queue and have Lambda poll the queue in batches to reduce the number of concurrent invocations.

Answer

Store the raw messages in an S3 bucket and use S3 Select to query the data for anomalies periodically.

Answer

Ingest the messages into Amazon Kinesis Data Streams with multiple shards, and use a Lambda function to process records from the stream. Increase the Lambda concurrency limit.

Question 9

A company is designing a microservices architecture on AWS. Each service needs its own DynamoDB table, and services must be fully isolated. Which networking design ensures that services can only communicate through APIs and not directly to each other's databases?

Accepted Answer

Create a separate VPC for each service, with VPC peering only between the API gateway and each service VPC.. Placing services in separate VPCs with VPC peering only for API communication ensures network-level isolation. Option B is correct because it prevents direct database access by not allowing peering between all VPCs. Option A is wrong because a shared VPC with security groups could allow unintended traffic. Option C is wrong because a single VPC with subnets still allows routing between services. Option D is wrong because a transit VPN does not provide the needed isolation.

Answer

Place all services in a single VPC with security groups to control traffic.

Answer

Use a transit VPC with VPN connections to each service's VPC.

Answer

Use a single VPC with public and private subnets; place databases in private subnets and services in public subnets.

Question 10

A company is migrating a legacy application to AWS. The application requires a shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones. The file system must provide high throughput and low latency. Which storage solution meets these requirements?

Accepted Answer

Use Amazon EFS with provisioned throughput.. Amazon EFS is a scalable, NFS-based file system that can be mounted by many EC2 instances across AZs and provides high throughput. Option B is correct. Option A is wrong because S3 is object storage, not a file system. Option C is wrong because EBS volumes can only be attached to a single instance in one AZ. Option D is wrong because FSx for Windows File Server is designed for Windows workloads, not general Linux file sharing.

Answer

Use Amazon EBS with a multi-attach enabled volume.

Answer

Use Amazon S3 with S3 File Gateway to present as a file system.

Answer

Use Amazon FSx for Windows File Server with a single file system.

Question 11

A solutions architect is designing a disaster recovery plan for a critical application. The application runs on EC2 instances behind an Application Load Balancer (ALB) in us-east-1. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. Which approach meets these requirements?

Accepted Answer

Use a warm standby: maintain a scaled-down copy of the environment in us-west-2 that can be scaled up within 15 minutes.. Using a warm standby with a scaled-down copy of the environment in another region and failing over within 15 minutes meets RTO/RPO. Option D is correct. Option A is wrong because pilot light takes longer to scale. Option B is wrong because backup and restore has higher RTO. Option C is wrong because multi-site active-active is overkill and may exceed RTO if not properly configured.

Answer

Use backup and restore: take hourly snapshots of EBS volumes and copy to us-west-2, then restore EC2 instances from snapshots.

Answer

Implement a pilot light strategy: replicate data to us-west-2 and keep a minimal stack running.

Answer

Deploy a multi-site active-active configuration with full capacity in both regions.

Question 12

A company is deploying a serverless application using AWS Lambda. The application processes high-resolution images and stores them in Amazon S3. The processing time for each image is variable, but some images require more than 15 minutes to process. Lambda has a maximum execution time of 15 minutes. How can the company process these long-running image transformations?

Accepted Answer

Use AWS Batch to run the image processing as a job on EC2 or Fargate.. Using AWS Step Functions to orchestrate Lambda functions with a task timeout of 15 minutes does not solve the 15-minute limit. However, splitting the work into parallel Lambda functions each under 15 minutes can process larger images if the work is parallelizable. But if processing a single image takes >15 minutes, you need to use a different compute service like AWS Batch. Option B is correct. Option A is wrong because Lambda still has the 15-minute limit. Option C is wrong because SQS doesn't extend Lambda execution time. Option D is wrong because Step Functions cannot extend Lambda timeout.

Answer

Use AWS Step Functions to chain multiple Lambda functions, each processing a part of the image.

Answer

Use Amazon SQS to queue the images and have Lambda poll the queue; the Lambda function can process one image per invocation.

Answer

Increase the Lambda timeout to 20 minutes.

Question 13

A company is designing a new web application that will be accessed by users worldwide. The application should have low latency and high availability. The application uses a stateless web tier and a relational database. Which architecture minimizes latency for global users?

Accepted Answer

Deploy the application in multiple regions with Route 53 latency-based routing, and use Amazon Aurora Global Database for the database tier.. Using Amazon Route 53 with latency-based routing to direct users to the closest region, and deploying the application in multiple regions with a global database, minimizes latency. Option D is correct. Option A is wrong because CloudFront alone doesn't handle dynamic content efficiently for all use cases. Option B is wrong because a single region cannot provide low latency globally. Option C is wrong because CloudFront can cache static content but dynamic requests still go to origin.

Answer

Deploy the application in a single region and use Route 53 geolocation routing.

Answer

Deploy the application in multiple regions, use CloudFront to cache static content, and route dynamic requests to the nearest region via Route 53 latency-based routing.

Answer

Deploy the application in a single region and use Amazon CloudFront to cache content globally.

Question 14

A company is deploying a containerized application on Amazon ECS. The application must be highly available and scale automatically based on CPU utilization. The application also needs to be accessible from the internet via a single endpoint. Which combination of services should the solutions architect use?

Accepted Answer

Amazon ECS with an Application Load Balancer and ECS Service Auto Scaling with a target tracking policy based on average CPU utilization.. Using an Application Load Balancer (ALB) in front of an ECS service with auto scaling using target tracking policies meets the requirements. Option C is correct. Option A is wrong because Network Load Balancer (NLB) does not support path-based routing and is less suitable for HTTP applications. Option B is wrong because ECS service auto scaling is needed, not step scaling for simple CPU. Option D is wrong because ECS service auto scaling with step scaling is more complex than needed.

Answer

Amazon ECS with a Network Load Balancer and step scaling policies.

Answer

Amazon ECS with an Application Load Balancer and step scaling policies based on CPU utilization.

Answer

Amazon ECS with an Application Load Balancer and manual scaling.

Question 15

A company is designing a new system to ingest and process real-time streaming data from thousands of IoT devices. The system must be able to handle variable throughput and provide durable storage for the data. The data will be processed by a Lambda function and then stored in Amazon S3. Which two services should be used together to build this ingestion pipeline?

Accepted Answer

AWS Lambda. Amazon Kinesis Data Streams provides durable, scalable ingestion, and AWS Lambda can process the data in real time. Option A and C are correct. Option B is wrong because Kinesis Data Firehose is used for loading data into destinations, not for real-time processing with Lambda (though it can invoke Lambda, but Data Streams is better for real-time). Option D is wrong because SQS is for message queues, not streaming. Option E is wrong because SNS is for pub/sub notifications.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon Simple Notification Service (SNS)