SAP-C02 Design for New Solutions Practice Test 18 — 15 Questions

Question 1

A financial services company is designing a new system on AWS to process real-time stock trades. The system must handle up to 10,000 trades per second with end-to-end latency under 500 milliseconds. Trades are ingested via REST API, validated, enriched with market data, and stored in a database for regulatory compliance. The architecture must be highly available across three Availability Zones. The company wants to use AWS managed services to minimize operational overhead. Which solution should a Solutions Architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon API Gateway to ingest trades, send to Amazon Kinesis Data Streams for buffering, use AWS Lambda to process in parallel, and store results in DynamoDB with on-demand capacity.. Amazon Kinesis Data Streams is purpose-built for high-throughput, low-latency ingestion of streaming data, and Lambda can process records in parallel with sub-second invocation latency. DynamoDB on-demand capacity absorbs unpredictable write bursts without pre-provisioning, and the combination is fully managed and Multi-AZ by default. This satisfies the 10,000 trades/sec and <500 ms end-to-end requirement while minimizing operational overhead.

Answer

Use Network Load Balancer to distribute trade requests to a fleet of EC2 instances running a custom Java application. The application processes trades and writes to Amazon RDS for MySQL with Multi-AZ.

Answer

Use Amazon API Gateway to ingest trades, publish to an SNS topic, subscribe an SQS queue and a Lambda function. Lambda validates and enriches, then stores in DynamoDB.

Answer

Use Amazon API Gateway to ingest trades, send to an SQS FIFO queue for ordered processing, trigger an AWS Lambda function for validation and enrichment, and store in DynamoDB.

Question 2

A global e-commerce company is designing a new recommendation engine on AWS. The engine processes user behavior data (clicks, purchases) from multiple sources in real time and updates recommendations stored in Amazon DynamoDB. The data stream can reach 100,000 events per second. The solution must be highly available and process events with minimal latency (< 1 second). The company wants to use a managed streaming service and a real-time processing framework. Which solution should a Solutions Architect recommend?

Accepted Answer

Use Amazon Kinesis Data Streams to ingest events, process them in real time with Amazon Kinesis Data Analytics using SQL, and write results to DynamoDB.. Amazon Kinesis Data Streams can ingest up to 100,000 events per second with shard-level scaling, and Kinesis Data Analytics (SQL) provides sub-second processing latency for real-time transformations. Writing directly to DynamoDB from the analytics application meets the <1 second latency requirement while maintaining high availability through Kinesis's built-in replication across three Availability Zones.

Answer

Use Amazon Kinesis Data Firehose to ingest events, transform data with Lambda, and deliver to DynamoDB.

Answer

Use Amazon Kinesis Data Streams to ingest events, use AWS Lambda to process each event, and write results to DynamoDB.

Answer

Use Amazon MSK (Managed Streaming for Apache Kafka) to ingest events, process them with Apache Spark Streaming on Amazon EMR, and write to DynamoDB.

Question 3

A company is designing a new application on AWS that processes real-time IoT sensor data from thousands of devices. The data must be ingested, processed, and stored for analysis. The company wants to use a serverless architecture to reduce operational overhead. The processing includes filtering, aggregation, and transformation. Which solution should a Solutions Architect recommend?

Accepted Answer

Use AWS IoT Core to ingest data, use IoT rules to route data to Kinesis Data Analytics for real-time processing, and store results in S3.. AWS IoT Core is designed for ingesting data from IoT devices at scale. IoT rules can route data to Kinesis Data Analytics for real-time processing (filtering, aggregation, transformation), and then store results in S3. This solution is fully serverless, reducing operational overhead, and leverages managed services for each stage.

Answer

Use Amazon Kinesis Data Streams to ingest data, use Kinesis Data Firehose to deliver data to S3, and use Athena for queries.

Answer

Use Amazon Kinesis Data Streams to ingest data, trigger a Lambda function for processing, and store results in DynamoDB.

Answer

Use Amazon SQS to ingest sensor data, trigger a Lambda function for processing, and store results in DynamoDB.

Question 4

A company is designing a new multi-region disaster recovery solution for a critical application running on AWS. The primary region is us-east-1. The application uses Amazon RDS for MySQL with Multi-AZ, and runs on EC2 instances behind an ALB. The RPO must be less than 5 minutes, and RTO less than 30 minutes. The company wants to minimize costs when the DR solution is not in use. Which solution should a Solutions Architect recommend?

Accepted Answer

Set up an RDS MySQL cross-Region read replica in us-west-2. Keep a standby EC2 environment with Auto Scaling configured to scale from 0 to minimum instances using a CloudWatch alarm on health checks. Use Route 53 failover routing to switch DNS to us-west-2.. A cross-Region read replica provides continuous asynchronous replication with RPO typically under a minute, satisfying the <5-minute requirement, while a standby EC2 environment scaled to zero via Auto Scaling keeps costs near zero when idle and can launch within the 30-minute RTO. Route 53 failover routing with health checks automates DNS cutover to us-west-2. This balances the RPO/RTO targets against the cost-minimization goal.

Answer

Use RDS MySQL with cross-Region read replicas in us-west-2. Use a hot standby EC2 environment with a single instance. Use Route 53 failover routing.

Answer

Back up RDS MySQL to S3 using automated snapshots and copy them to us-west-2. Use EC2 instances with S3-mounted volumes to serve traffic from the backup.

Answer

Use RDS MySQL with Multi-AZ in us-east-1 and a second Multi-AZ deployment in us-west-2. Keep EC2 instances running in us-west-2 behind an ALB with cross-Region load balancing.

Question 5

A company is building a new data lake on AWS to store and analyze petabytes of data from various sources. The data includes structured (CSV, Parquet), semi-structured (JSON), and unstructured (images, videos) files. The company needs a cost-effective storage solution that allows running SQL queries directly on the data without loading it into a database. Data is accessed infrequently but must be available within minutes. Which solution should a Solutions Architect recommend?

Accepted Answer

Store data in Amazon S3 using lifecycle policies to transition infrequent data to S3 Standard-IA. Use Amazon Athena for SQL queries.. Amazon S3 is the ideal storage for a data lake, supporting structured, semi-structured, and unstructured data. Lifecycle policies can transition infrequent data to S3 Standard-IA to reduce costs while maintaining low latency retrieval. Amazon Athena enables serverless SQL queries directly on data stored in S3 without requiring loading into a database. Option A is incorrect because S3 Glacier Deep Archive is for long-term archival with retrieval times of hours, not minutes, making it unsuitable for queries that require availability within minutes. Option B is incorrect because Amazon Redshift is a data warehouse that requires data to be loaded into it; Redshift Spectrum can query S3, but the primary storage is not designed for a data lake scenario where data is queried directly. Option D is incorrect because Amazon EBS is block storage attached to a single EC2 instance, which does not provide the scalability or cost-effectiveness for petabytes of data in a data lake.

Answer

Store data in Amazon S3 Glacier Deep Archive for cost savings, and use Athena for queries.

Answer

Store data in Amazon Redshift, use Redshift Spectrum to query data in S3.

Answer

Store data in Amazon EBS volumes attached to an EC2 instance running a SQL engine.

Question 6

A company is designing a new event-driven architecture on AWS for processing orders. When a new order is placed, it must be validated, inventory checked, payment processed, and notification sent. Each step is independent and may take variable time. The company wants to decouple the steps and ensure that failures do not block the entire workflow. Which solution should a Solutions Architect recommend?

Accepted Answer

Use AWS Step Functions to define a state machine that invokes Lambda functions for each step, with retry and error handling.. AWS Step Functions is the correct choice because it provides a fully managed state machine that can orchestrate multiple Lambda functions with built-in retry logic, error handling, and parallel execution. This decouples each step (validation, inventory, payment, notification) while ensuring that failures in one step do not block the entire workflow, as Step Functions can handle errors gracefully with configurable retries and fallback states.

Answer

Use Amazon SQS queues for each step, with Lambda functions polling each queue and forwarding to the next step.

Answer

Use Amazon SNS to publish order events, and subscribe separate Lambda functions for validation, inventory, payment, and notification.

Answer

Create a single Lambda function that performs all steps sequentially.

Question 7

A company is designing a new application on AWS that will store sensitive user data. The application must comply with data residency requirements, meaning data must remain within a specific geographic region. Which TWO architectural decisions should a Solutions Architect make to ensure compliance?

Accepted Answer

Deploy all resources in a single AWS region that meets the data residency requirement.. Option A is correct because deploying all resources in a single AWS Region that satisfies the data residency requirement ensures that data at rest and in transit stays within that approved geographic boundary, since AWS Regions are physically isolated from one another. Option B is correct because S3 bucket policies can include condition keys such as aws:RequestedRegion or aws:SourceIp to explicitly deny requests that originate from outside the required region, adding an enforcement control that prevents accidental or unauthorized cross-region access. Option C is not correct because CloudFront edge locations are distributed globally and caching content at edge locations outside the required region could violate data residency. Option D is not correct because KMS with customer managed keys provides encryption and key control but does not by itself constrain where data is stored or processed. Option E is not correct because cross-Region replication deliberately copies S3 data to another Region, which directly conflicts with data residency requirements.

Answer

Use Amazon CloudFront to serve content from edge locations.

Answer

Use AWS Key Management Service (KMS) with customer managed keys.

Answer

Enable cross-Region replication for data stored in Amazon S3.

Question 8

A financial services company is designing a new system on AWS to process real-time stock trades. The system must handle up to 10,000 trades per second with end-to-end latency under 500 milliseconds. Trades are ingested via REST API, validated, enriched with market data, and stored in a database for regulatory compliance. The architecture must be highly available across three Availability Zones. The company wants to use AWS managed services to minimize operational overhead. Which solution should a Solutions Architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use SSE-KMS with a customer managed key in AWS KMS.. The requirements for customer-controlled key material, audited access, and annual rotation align with AWS KMS customer managed keys used with SSE-KMS. This approach allows the security team to define key policies, enable rotation, and monitor usage via CloudTrail. Immediate revocation is possible by disabling the key. Other methods either lack auditability, rotation, or require manual key management.

Answer

Use SSE-S3 with Amazon S3 managed keys.

Answer

Use SSE-C with a customer-provided key.

Answer

Use client-side encryption with an AWS KMS customer managed key.

Question 9

A retail company is designing a new order-processing system on AWS. The system will use Amazon SQS FIFO queues to ensure exactly-once processing of orders, and AWS Lambda functions to process messages. The company expects up to 500 orders per second during peak periods. The solutions architect must recommend a design that scales automatically and minimizes operational overhead. Which approach should the architect recommend?

Accepted Answer

Use an SQS FIFO queue with Lambda event source mapping, and set the batch size to 10 with a batch window of 0 seconds.. SQS FIFO queues provide exactly-once processing and maintain order, which are critical for order processing. When integrated with Lambda, the event source mapping automatically scales by adding more pollers, and with a sufficient number of message groups, it can achieve high throughput. This design is serverless, reducing operational overhead. Other options either do not guarantee exactly-once processing or require manual scaling and management.

Answer

Use an SQS FIFO queue and deploy a fleet of Amazon EC2 instances that poll the queue and process orders in parallel.

Answer

Use an Amazon Kinesis Data Stream with a Lambda function that processes records in order, and set the parallelization factor to 10.

Answer

Use a standard SQS queue with a Lambda function that processes messages idempotently, and enable a dead-letter queue for failed messages.

Question 10

A financial services company is building a new multi-account AWS environment with AWS Organizations. The security team requires that all Amazon S3 buckets across every member account enforce server-side encryption with AWS KMS keys (SSE-KMS) and that any bucket creation without encryption be automatically remediated. The solution must apply uniformly to existing and future accounts, and the security team wants to minimize ongoing operational overhead. Which combination of actions should a solutions architect take to meet these requirements?

Accepted Answer

Create an SCP that denies the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption condition key set to aws:kms, and attach the SCP to the root of the organization.. A service control policy attached to the organization root enforces encryption at the point of bucket creation across all accounts, including future ones, without requiring per-account configuration. It uses the s3:x-amz-server-side-encryption condition key to require SSE-KMS, providing a preventive, centralized control that meets the security team's requirements with minimal operational overhead.

Answer

Configure Amazon S3 Block Public Access at the organization level and enable default encryption on all buckets using the S3 console. Then use AWS Trusted Advisor to monitor for unencrypted buckets.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates an S3 bucket with default encryption enabled in every account, and use a drift detection schedule to identify non-compliant buckets.

Answer

Enable AWS Config in each member account with a custom rule that checks for S3 bucket encryption, and use an AWS Lambda function to enable default encryption when a non-compliant bucket is detected.

Question 11

A financial services company is designing a new system on AWS to process real-time stock trades. The system must handle up to 10,000 trades per second with end-to-end latency under 500 milliseconds. Trades are ingested via REST API, validated, enriched with market data, and stored in a database for regulatory compliance. The architecture must be highly available across three Availability Zones. The company wants to use AWS managed services to minimize operational overhead. Which solution should a Solutions Architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon Kinesis Data Streams to ingest events, AWS Lambda to enrich with DynamoDB, and Amazon Kinesis Data Firehose to deliver to Amazon S3.. The scenario requires high-throughput, low-latency ingestion with enrichment and delivery to S3, all with minimal operational overhead. Kinesis Data Streams ingests and scales automatically, Lambda processes records in real time, and Kinesis Data Firehose reliably delivers to S3. This combination is fully managed and meets the scale and reliability needs.

Answer

Use Amazon Managed Streaming for Apache Kafka (Amazon MSK) to ingest events, AWS Lambda to enrich with DynamoDB, and Amazon Kinesis Data Firehose to deliver to Amazon S3.

Answer

Use Amazon SQS to queue events, AWS Lambda to enrich with DynamoDB, and AWS Glue to write to Amazon S3.

Answer

Use Amazon EventBridge to route events, AWS Step Functions to enrich with DynamoDB, and Amazon S3 Transfer Acceleration to deliver to S3.

Question 12

A company is designing a new serverless application using AWS Lambda and Amazon DynamoDB. The application must handle sudden spikes in traffic and maintain high availability. The company wants to ensure that the DynamoDB table can scale automatically and that the Lambda functions can handle the load without throttling. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Use DynamoDB on-demand capacity mode for the table.. To handle sudden traffic spikes, DynamoDB must scale automatically. Both auto scaling (for provisioned mode) and on-demand capacity mode achieve this. Auto scaling adjusts capacity based on utilization, while on-demand instantly accommodates spikes. For Lambda, concurrency scales automatically; the key is to ensure the downstream DynamoDB table can handle the increased load without throttling. Provisioned concurrency and reserved concurrency are for different purposes and do not provide automatic scaling for unpredictable spikes.

Answer

Increase the Lambda function's reserved concurrency to the maximum allowed.

Answer

Increase the Lambda function's memory allocation to the maximum.

Answer

Configure the Lambda function to use provisioned concurrency.

Question 13

A global SaaS provider is launching a new multi-tenant analytics platform. Each of 4,000 tenants must have isolated data storage, and tenants are distributed across North America, Europe, and Asia. The security team requires that each tenant's data encryption keys be automatically rotated annually and that a single compromised key never exposes more than one tenant's data. The platform will store 50 TB per tenant and must support point-in-time recovery for the last 35 days. Which combination of AWS services and features should a solutions architect recommend to meet these requirements with the LEAST operational overhead?

Accepted Answer

Amazon S3 with per-tenant prefixes in a single bucket in each Region, encrypted with SSE-KMS using a tenant-specific customer managed key per Region, with S3 Versioning enabled and an S3 Lifecycle rule to expire noncurrent versions after 35 days.. The requirements demand cryptographic isolation per tenant, automatic annual key rotation, 35-day point-in-time recovery, and global distribution with low operational overhead. Tenant-specific customer managed keys in AWS KMS satisfy the isolation and rotation needs, while S3 Versioning plus a lifecycle rule expiring noncurrent versions after 35 days delivers the recovery window. Placing buckets in each Region keeps data near tenants and avoids manual replication management.

Answer

Amazon S3 with a single bucket and per-tenant prefixes, encrypted with SSE-KMS using one customer managed key, with S3 Versioning and S3 Object Lock in governance mode for 35 days.

Answer

Amazon S3 with a single bucket per Region and per-tenant prefixes, encrypted with SSE-S3 using Amazon S3 managed keys, with S3 Versioning and S3 Cross-Region Replication configured for all objects.

Answer

Amazon S3 with a separate bucket per tenant, each bucket encrypted with SSE-KMS using a tenant-specific customer managed key in the same AWS Region, with S3 Versioning and S3 Lifecycle policies enabled.

Question 14

A company is designing a new global web application that will be deployed on AWS. The application must provide low-latency access to users worldwide and must be able to fail over between AWS Regions in case of a regional outage. The company wants to use Amazon Route 53 for DNS. The solutions architect needs to recommend a routing policy and a health check configuration that meet these requirements. (Choose two.)

Accepted Answer

Use a failover routing policy with a primary and secondary region, and configure health checks on both regions.. Latency-based routing directs users to the lowest-latency region, and with health checks, it can fail over if a region becomes unhealthy. Failover routing explicitly designates a primary and secondary region, with health checks triggering automatic failover. Together, these policies can meet the requirements for low latency and regional failover. Other policies either lack automatic failover or are not optimized for latency.

Answer

Use a multivalue answer routing policy with health checks on all regions.

Answer

Use a weighted routing policy with health checks, assigning weights based on region capacity.

Answer

Use a geolocation routing policy to route users to the closest region based on their location.

Question 15

A company is designing a new real-time analytics platform that ingests clickstream data from millions of users. The data must be processed in near real-time and stored in a data lake for later analysis. The company wants to use a serverless architecture to minimize operational overhead. Which combination of AWS services should be used?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, and Amazon S3.. For serverless, near real-time ingestion and processing of clickstream data, Kinesis Data Streams captures the data, Lambda processes it in real-time, and S3 stores it as a data lake. All are fully managed and scale automatically. This meets the requirements with minimal operational overhead.

Answer

AWS IoT Core, AWS Lambda, and Amazon DynamoDB.

Answer

Amazon SQS, AWS Lambda, and Amazon Redshift.

Answer

Amazon Kinesis Data Firehose, AWS Glue, and Amazon S3.