SAP-C02 Design for New Solutions Practice Test 17 — 15 Questions

Question 1

A company is designing a new cloud-native application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application handles user authentication using Amazon Cognito User Pools. During a stress test, the team notices that some requests are failing with HTTP 503 (Service Unavailable) errors. The CloudWatch logs show that Lambda functions are being throttled, and the DynamoDB table is experiencing high write throttling. The team needs to resolve these issues while maintaining low latency. Which solution is the MOST effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set Lambda reserved concurrency to a value that covers peak load and enable DynamoDB auto scaling with a target utilization of 70%.. Setting Lambda reserved concurrency ensures that the function always has capacity available to handle peak load without being throttled by the account-level concurrency limit, while DynamoDB auto scaling with a target utilization of 70% dynamically adjusts write capacity to match traffic patterns, preventing write throttling. This combination directly addresses both throttling issues without introducing additional latency from buffering or caching layers.

Answer

Use Amazon SQS to buffer requests to Lambda and configure a DynamoDB Accelerator (DAX) cluster for caching.

Answer

Increase the DynamoDB write capacity units to the maximum expected peak and configure Lambda provisioned concurrency.

Answer

Replace AWS Lambda with Amazon ECS on Fargate and use an Application Auto Scaling target tracking policy.

Question 2

A company is designing a microservices architecture on AWS ECS with Fargate. Each service needs to store and retrieve session state. The solution must be highly available and low latency. Which AWS service should be used for session state storage?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides an in-memory data store with sub-millisecond latency, ideal for session state storage in a microservices architecture. Redis supports data structures like hashes and strings that map directly to session data patterns, and its replication and cluster modes ensure high availability across multiple Availability Zones. Fargate tasks can connect to ElastiCache via private subnets, maintaining low latency without the overhead of disk-based I/O.

Answer

Amazon RDS for MySQL

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 3

A company wants to store application logs in a centralized location for analysis. The logs are generated by EC2 instances in an Auto Scaling group. The solution must be cost-effective and support real-time analysis. Which service should be used to collect and analyze the logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct choice because it natively integrates with EC2 instances via the CloudWatch Logs agent to collect, monitor, and analyze log data in real time. It provides a centralized log storage with built-in metric filters and subscription filters for real-time analysis, making it cost-effective for logs generated by Auto Scaling groups without requiring additional infrastructure.

Answer

Amazon S3

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Elasticsearch Service

Question 4

A company is designing a disaster recovery solution for a critical application running on EC2 with data in an Amazon RDS MySQL Multi-AZ DB instance. The recovery time objective (RTO) is 15 minutes and recovery point objective (RPO) is 1 hour. Which strategy meets these requirements?

Accepted Answer

Create a cross-Region read replica of the RDS DB instance.. A cross-Region read replica of an Amazon RDS MySQL DB instance provides asynchronous replication with a typical replication lag of seconds to minutes, meeting the RPO of 1 hour and RTO of 15 minutes by promoting the replica to a standalone instance in the event of a disaster. This approach minimizes data loss and allows rapid failover without relying on snapshot restoration or backup copying.

Answer

Enable Multi-AZ in a different Region.

Answer

Take daily snapshots of the RDS DB instance and copy them to another Region.

Answer

Use Amazon S3 cross-Region replication for database backups.

Question 5

A company wants to implement a serverless data processing pipeline on AWS. The pipeline reads CSV files from Amazon S3, transforms the data, and loads it into Amazon Redshift. Which THREE AWS services should be used to build this pipeline?

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered by S3 events when a CSV file is uploaded, and it can execute lightweight data transformation logic (e.g., parsing CSV rows, filtering, or converting formats) before loading the data into Amazon Redshift. Lambda is serverless, scales automatically, and integrates natively with S3 and Redshift via the AWS SDK, making it ideal for event-driven, short-running transformations in a serverless pipeline.

Answer

AWS Database Migration Service (DMS)

Answer

Amazon EC2

Question 6

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to be accessible from the internet and must be secured with an AWS WAF. Which TWO steps should be taken to achieve this?

Accepted Answer

Associate the ALB with an AWS WAF web ACL.. AWS WAF can be associated with an Application Load Balancer (ALB) to filter HTTP/HTTPS traffic at the application layer. This allows you to protect the containerized application from common web exploits like SQL injection or cross-site scripting. Option B is correct because an ALB is required to route internet traffic to the ECS Fargate service and to terminate TLS, which is necessary for WAF to inspect the request payload.

Answer

Use a Network Load Balancer in front of the ECS service.

Answer

Assign public IP addresses to the Fargate tasks.

Answer

Use Amazon CloudFront as a CDN.

Question 7

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use to decouple the services while providing durable message storage?

Accepted Answer

Amazon SQS. Amazon SQS (Simple Queue Service) is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, decoupling them so that producers and consumers operate independently. SQS offers durable message storage by persisting messages across multiple Availability Zones, ensuring messages are not lost even if a consumer fails. This aligns with the requirement for loose coupling and reliable message delivery.

Answer

Amazon SNS

Answer

Amazon EventBridge

Answer

Amazon Kinesis Data Streams

Question 8

A company is designing a new application that will store sensitive data in Amazon S3. The data must be encrypted at rest using a key that is rotated every 90 days. The company wants to use AWS managed services to minimize operational overhead. Which encryption solution should they choose?

Accepted Answer

SSE-S3. SSE-S3 (Amazon S3 managed keys) provides encryption at rest with automatic key rotation every 90 days, meeting the requirement without any operational overhead. The company wants AWS managed services to minimize operational overhead, and SSE-S3 handles key management and rotation entirely on the customer's behalf, with no configuration needed.

Answer

SSE-C

Answer

Client-side encryption with AWS KMS

Answer

SSE-KMS with automatic rotation

Question 9

A company is designing a new serverless application using AWS Lambda. The function must process a file uploaded to S3 and then send a notification to an external API. The external API has a rate limit of 10 requests per second. Which approach should they use to handle throttling?

Accepted Answer

Use Amazon SQS to buffer the requests and set a Lambda reserved concurrency to limit the processing rate. Amazon SQS acts as a durable buffer that decouples the S3 event from the Lambda invocation, allowing the function to poll messages at a controlled rate. By setting a Lambda reserved concurrency, you limit the number of concurrent executions, which directly caps the processing rate to stay within the external API's 10 requests per second limit. This combination ensures that the Lambda function does not exceed the API's throttling threshold while still processing all events reliably.

Answer

Increase the Lambda function timeout and retry on failure

Answer

Configure a Lambda function destination on failure to reprocess

Answer

Use Amazon SNS to fan out the notification to multiple Lambda functions

Question 10

A company is designing a new cloud-native application that will run on Amazon ECS with Fargate. The application must store logs centrally for analysis. Which TWO services can be used to collect and analyze logs from ECS Fargate tasks?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the native log management service for AWS, and ECS Fargate tasks can be configured to send stdout/stderr logs directly to CloudWatch Logs using the 'awslogs' log driver. This provides centralized log collection, storage, and analysis with features like metric filters and log insights, making it a correct choice for collecting and analyzing logs from Fargate tasks.

Answer

Amazon S3

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Analytics

Question 11

A company is designing a new VPC for a web application that must be accessible from the internet. The application will run on EC2 instances in private subnets. Which TWO components are required to allow the EC2 instances to access the internet for updates?

Accepted Answer

A route table in the private subnet with a default route pointing to the NAT Gateway. A route table in the private subnet with a default route (0.0.0.0/0) pointing to a NAT Gateway is required to direct outbound internet traffic from the EC2 instances to the NAT Gateway. The NAT Gateway then forwards this traffic to the Internet Gateway, enabling the instances to download updates while remaining inaccessible from the internet.

Answer

An Internet Gateway attached to the VPC

Answer

VPC Flow Logs

Answer

A virtual private gateway

Question 12

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 13

A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon ECS with Fargate. The compliance team requires that all data in transit between the application and the database must be encrypted. The database is an Amazon RDS for PostgreSQL instance. The application connects to the database using a connection string that includes the database endpoint. The security team has enabled encryption in transit on the RDS instance using a certificate. The application is currently failing to connect to the database with an error related to SSL/TLS. The development team verified that the connection string includes the sslmode=require parameter. What is the most likely cause of the connection failure?

Accepted Answer

The RDS DB parameter group does not have the 'rds.force_ssl' parameter set to 1.. The most likely cause is that the RDS DB parameter group does not have the 'rds.force_ssl' parameter set to 1. Even though the application uses sslmode=require in the connection string, the RDS instance must enforce SSL connections by setting this parameter. Without it, the RDS instance may not require SSL, leading to a connection failure when the client attempts to negotiate SSL. Option A is incorrect because RDS uses certificates signed by a trusted CA; the issue is not about trust. Option B is incorrect because the database port is 5432, not 443. Option C is incorrect because Fargate containers include necessary SSL libraries by default.

Answer

The RDS instance is using a public certificate that is not trusted by the application.

Answer

The security group for the RDS instance does not allow inbound traffic on port 443.

Answer

The Fargate task does not have the necessary SSL libraries installed.

Question 14

A media company is designing a new video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function to start an AWS Elemental MediaConvert job. The MediaConvert job uses a custom job template. The pipeline must handle bursty uploads of up to 50 videos simultaneously. The company has noticed that some uploads are not being processed. The Lambda function is configured with a reserved concurrency of 10. The S3 event notification is configured to send events to the Lambda function. The MediaConvert job template is configured correctly. What is the most likely reason for the missed processing?

Accepted Answer

The Lambda function's reserved concurrency of 10 is too low, causing throttling and missed events.. The Lambda function has a reserved concurrency of 10, which limits the number of concurrent executions to 10. When 50 videos are uploaded simultaneously, S3 event notifications trigger Lambda invocations, but only 10 can run concurrently. The remaining invocations are throttled. With S3 event notifications, if Lambda throttles, the event is retried with exponential backoff, but if throttling persists beyond the retry duration (up to 6 hours), events are dropped. Thus, some uploads are not processed.

Answer

The MediaConvert job template is not being applied correctly.

Answer

The S3 event notification is not guaranteed to deliver events.

Answer

The Lambda function is failing due to a timeout.

Question 15

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web frontend, a REST API, and a PostgreSQL database. The migration plan is to containerize the frontend and API using Amazon ECS with Fargate, and use Amazon RDS for PostgreSQL. The company expects variable traffic with peak loads during promotional events. The architecture must be highly available and cost-effective. The operations team wants to minimize manual scaling interventions. Which solution should a Solutions Architect recommend?

Accepted Answer

Deploy the API and frontend on Amazon ECS with Fargate. Use Application Auto Scaling with target tracking based on average CPU and memory utilization. Use Amazon RDS for PostgreSQL with Multi-AZ deployment and Auto Scaling for storage.. The requirement is to minimize changes to the existing architecture (PostgreSQL stays as RDS PostgreSQL, not DynamoDB), achieve high availability (Multi-AZ), and minimize manual scaling (Application Auto Scaling with target tracking on ECS Fargate). Option B matches all constraints: Fargate removes server management, target tracking on CPU/memory handles variable promotional traffic automatically, RDS Multi-AZ provides HA, and storage autoscaling handles database growth.

Answer

Deploy the API and frontend on Amazon ECS with Fargate. Use Application Auto Scaling with target tracking based on average CPU and memory utilization. Use Amazon DynamoDB for the database with on-demand capacity mode.

Answer

Deploy the API and frontend on Amazon EC2 instances behind an Application Load Balancer. Use Auto Scaling groups with dynamic scaling policies. Use Amazon RDS for PostgreSQL with Multi-AZ deployment.

Answer

Deploy the API and frontend on Amazon ECS with Fargate. Configure a scheduled task to scale out during known promotional events. Use Amazon RDS for PostgreSQL with Multi-AZ deployment.