SAP-C02 Design for New Solutions Practice Test 18 — 15 Questions

Question 1

A startup is deploying a web application on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon DynamoDB table. To improve performance, the team wants to reduce latency for read-heavy workloads. Which design change would be MOST effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the session table.. DynamoDB Accelerator (DAX) is a fully managed, in-memory cache specifically designed for Amazon DynamoDB. It reduces read latency from single-digit milliseconds to microseconds by caching frequently accessed items, making it ideal for read-heavy session state workloads without requiring application-level cache management.

Answer

Add an Amazon ElastiCache Redis cluster in front of DynamoDB to cache session data.

Answer

Use an Auto Scaling group to add more EC2 instances during peak hours.

Answer

Increase the size of the EC2 instances to handle more concurrent users.

Question 2

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application currently uses a central MySQL database. The architects plan to refactor the database into separate RDS instances per microservice. Which strategy will ensure data consistency across services with minimal application changes?

Accepted Answer

Implement a saga pattern using choreography, where each service publishes events and reacts to events from other services.. The saga pattern with choreography allows each microservice to maintain its own RDS instance while ensuring data consistency through a sequence of local transactions and compensating events. This approach avoids the need for distributed transactions across separate databases, which aligns with the goal of minimal application changes by leveraging existing event-driven communication patterns in ECS with Fargate.

Answer

Enable the STRICT_TRANS_TABLES SQL mode on all RDS instances to enforce data integrity.

Answer

Configure RDS read replicas for each service to ensure eventually consistent reads.

Answer

Use distributed transactions with a two-phase commit protocol across RDS instances.

Question 3

A media company is designing a video transcoding pipeline using AWS Lambda and Amazon S3. The pipeline must process videos uploaded to an S3 bucket, transcode them into multiple formats, and store the results in another S3 bucket. The processing time for each video can vary from a few seconds to several minutes. Which architecture will minimize cost and ensure all videos are processed, even if Lambda execution timeout is reached?

Accepted Answer

Configure S3 event notifications to send messages to an Amazon SQS queue. Have Lambda poll the queue and process each message. Set the SQS visibility timeout to match the expected maximum processing time.. Using S3 event notifications to send messages to an Amazon SQS queue decouples the upload from processing, allowing Lambda to poll the queue at its own pace. Setting the visibility timeout to match the expected maximum processing time ensures that if a Lambda invocation times out, the message becomes visible again after the visibility timeout, so it can be reprocessed. This minimizes cost (no additional services like Step Functions or Kinesis) and guarantees all videos are processed. Option A is incorrect because direct Lambda invocation via S3 events can lead to throttling under high concurrency, and the dead-letter queue only captures events after all retries fail, but timeouts within the function may not be handled elegantly. Option B is incorrect because AWS Step Functions adds cost and complexity for orchestration; while it can manage long-running workflows, the simpler SQS approach is more cost-effective. Option D is incorrect because Amazon Kinesis Data Streams is designed for real-time streaming and is overkill for this batch-oriented transcoding pipeline, increasing cost and complexity.

Answer

Configure S3 event notifications to invoke Lambda directly and use a dead-letter queue to capture failed events.

Answer

Use AWS Step Functions to orchestrate the transcoding workflow, with each step as a separate Lambda function.

Answer

Use Amazon Kinesis Data Streams to ingest S3 events and have Lambda process records from the stream.

Question 4

A company is designing a new web application that will be accessed by users globally. The application uses Amazon CloudFront as a CDN and stores static content in Amazon S3. The dynamic content is served from EC2 instances in a single AWS Region. Which of the following will improve performance for users in distant regions with the LEAST operational effort?

Accepted Answer

Use AWS Global Accelerator to route traffic to the EC2 instances via the AWS global network.. AWS Global Accelerator uses the AWS global network to route traffic from edge locations to the optimal EC2 endpoint, reducing latency and jitter for distant users without requiring multi-region deployments. This minimizes operational effort because it involves only a single configuration change (creating an accelerator and associating it with the existing EC2 instances) rather than managing infrastructure across multiple regions.

Answer

Deploy EC2 instances in multiple AWS Regions and use Route 53 latency-based routing.

Answer

Move the dynamic content to Lambda@Edge functions running at CloudFront edge locations.

Answer

Add an Amazon ElastiCache cluster in front of the EC2 instances to cache dynamic responses.

Question 5

A company is building a data lake on Amazon S3 using Parquet files. The data will be queried by multiple teams using Amazon Athena. The security team requires that access to sensitive columns (e.g., PII) be restricted based on the user's role. Which solution provides column-level access control with the LEAST administrative overhead?

Accepted Answer

Use AWS Lake Formation to define column-level permissions in the Data Catalog.. AWS Lake Formation provides native column-level filtering in the Data Catalog, allowing you to define granular permissions on specific columns of a table without moving or duplicating data. When Athena queries a table registered with Lake Formation, the service automatically applies column-level access controls based on the IAM role or user, enforcing the restriction at query runtime with minimal administrative overhead.

Answer

Create separate S3 buckets for sensitive and non-sensitive data and apply bucket policies to restrict access.

Answer

Load the data into Amazon Redshift and use Redshift Spectrum to query S3, then apply column-level security through Redshift.

Answer

Use IAM policies with condition keys to restrict access based on the Athena workgroup.

Question 6

A financial services company is designing a multi-tier application that must achieve a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes for a database tier. The application uses Amazon RDS for MySQL with Multi-AZ deployment. Which disaster recovery strategy meets these requirements at the LOWEST cost?

Accepted Answer

Create a cross-Region read replica of the RDS MySQL instance in another Region. In a disaster, promote the read replica to a standalone instance.. A cross-Region read replica for Amazon RDS MySQL provides asynchronous replication with an RPO typically under 15 minutes, and promoting it during a disaster can achieve an RTO of 1 hour. This approach incurs only the cost of the replica instance and cross-Region data transfer, making it the lowest-cost option that meets the stated RTO and RPO requirements.

Answer

Deploy the RDS instance in Multi-AZ configuration and take frequent snapshots to another Region.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to an RDS instance in another Region.

Answer

Use Amazon Aurora Global Database, which provides global replication with typical RPO of 1 second.

Question 7

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 100 Mbps internet connection. The migration must be completed within a week and have minimal downtime. Which AWS service should the company use to transfer the initial database dump to AWS?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to migrate the data with minimal downtime.. AWS DMS with ongoing replication (change data capture) is the correct choice because it allows the initial full load of the 2 TB database to be migrated while continuously capturing and applying changes from the source Oracle database. This minimizes downtime to a brief cutover window, meeting the requirement of minimal downtime. The 100 Mbps internet connection is sufficient for the initial load over a week (2 TB at 100 Mbps ≈ 2.3 days theoretical), and DMS handles the schema conversion and data transfer natively without requiring manual dump files.

Answer

Upload the database dump directly to an S3 bucket using multipart upload.

Answer

Use AWS Snowball Edge to transfer the data offline.

Answer

Use S3 Transfer Acceleration to speed up the upload of the dump file.

Question 8

Which TWO actions will improve the security posture of an Amazon S3 bucket used to store sensitive data? (Choose two.)

Accepted Answer

Enable S3 Block Public Access settings at the account or bucket level.. S3 Block Public Access settings provide a centralized, account- or bucket-level control that overrides any bucket policies or object ACLs that would grant public access, effectively preventing data exposure. Option E is correct because a bucket policy condition that restricts access to requests originating from a specific VPC or IP range limits the attack surface by ensuring only authorized network paths can reach the bucket, which is a key security best practice for sensitive data.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable default encryption using SSE-S3.

Answer

Enable S3 server access logging for the bucket.

Question 9

A company is designing a high-performance computing (HPC) workload on AWS. The workload requires tightly coupled inter-node communication with low latency and high bandwidth. Which THREE services or features should the architect consider to meet these requirements? (Choose three.)

Accepted Answer

EC2 instances with enhanced networking and high-throughput (e.g., p4d, p3dn). EC2 instances like p4d and p3dn are designed for HPC workloads, offering enhanced networking (up to 100 Gbps) and high-throughput capabilities. These instances support Elastic Fabric Adapter (EFA) and are optimized for tightly coupled inter-node communication, providing the low latency and high bandwidth required for HPC.

Answer

VPC peering between multiple VPCs

Answer

AWS Global Accelerator

Question 10

Which TWO strategies can reduce the cost of storing infrequently accessed data in Amazon S3 while maintaining millisecond retrieval latency? (Choose two.)

Accepted Answer

Use S3 Standard-IA for data that is accessed less frequently but requires millisecond retrieval.. S3 Standard-IA (Infrequent Access) is designed for data accessed less frequently but still requires millisecond retrieval latency, making it a cost-effective choice for infrequently accessed data without sacrificing performance. Option D is correct because S3 Intelligent-Tiering automatically moves objects between access tiers (e.g., from S3 Standard to S3 Standard-IA) based on changing access patterns, optimizing costs while maintaining millisecond latency for frequently accessed data.

Answer

Transition objects to S3 Glacier Flexible Retrieval after 90 days.

Answer

Use S3 Glacier Deep Archive for data older than 30 days.

Answer

Use S3 One Zone-IA for all data to reduce storage costs.

Question 11

Which THREE design patterns can help a microservices application achieve loose coupling and independent deployability? (Choose three.)

Accepted Answer

Circuit breaker pattern to handle service failures. The circuit breaker pattern (B) prevents cascading failures by monitoring for failures and opening the circuit to stop calls to an unhealthy service, allowing it time to recover. This supports loose coupling because the caller does not need to know the internal state of the downstream service, and it enables independent deployability by isolating failures during deployment or scaling events.

Answer

Shared database schema across services

Answer

Synchronous RESTful HTTP calls between services

Question 12

A company runs a critical web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) with a target group that has health checks configured. Recently, the operations team noticed that during a deployment, the ALB started routing traffic to a new instance before it was ready to serve requests, causing a brief period of errors. The team wants to ensure that new instances are fully initialized and ready before receiving traffic. The application takes about 30 seconds to start up. Current health check settings: health check protocol HTTP, path /, interval 30 seconds, timeout 5 seconds, healthy threshold 2, unhealthy threshold 2. The deployment uses the Auto Scaling group's instance refresh feature. Which of the following is the MOST effective way to prevent traffic from being sent to instances that are not ready?

Accepted Answer

Implement a lifecycle hook in the Auto Scaling group that waits for the instance to signal readiness. Also, configure the target group health check with a longer interval and a higher healthy threshold to ensure the instance is fully operational.. It uses a lifecycle hook to pause the instance until it signals readiness (e.g., via a custom script that completes initialization), and then configures the target group health check with a longer interval and higher healthy threshold to ensure the instance is fully operational before receiving traffic. This prevents the ALB from routing traffic to an instance that is not yet ready. Option B is wrong because simply increasing the health check interval and threshold does not guarantee the instance has finished its startup process; it may still fail if the application is not ready when the first health check occurs (if the instance takes 30 seconds and interval is 60, the first check is at 60 seconds, but the threshold of 5 means it needs 5 consecutive successes, which delays traffic but doesn't ensure the instance is fully functional from the start). Option C is wrong because the instance refresh warm-up time only delays the start of the refresh process, not the time before an instance receives traffic; it does not integrate with application readiness. Option D is wrong because AWS Global Accelerator does not pre-warm endpoints; it provides static IP addresses and improves performance but does not handle application readiness checks.

Answer

Increase the health check interval to 60 seconds and the healthy threshold to 5.

Answer

Use the Auto Scaling group's instance refresh feature with a warm-up time of 60 seconds.

Answer

Use AWS Global Accelerator to pre-warm the endpoints before directing traffic.

Question 13

A company is designing a data processing pipeline for real-time analytics. The pipeline ingests data from IoT devices that send JSON messages via MQTT to AWS IoT Core. The messages must be processed in real-time to detect anomalies and the results must be stored in Amazon S3 for later analysis. The company currently uses a Lambda function to process each message, but as the number of devices grows, the Lambda function is being throttled due to concurrency limits. The company needs a solution that scales to handle thousands of devices per second without losing messages. The processed data must be available in S3 within 1 minute of ingestion. Which architecture should the company use?

Accepted Answer

Ingest the messages into Amazon Kinesis Data Streams with multiple shards, and use a Lambda function to process records from the stream. Increase the Lambda concurrency limit.. The correct architecture is to ingest messages into Amazon Kinesis Data Streams with multiple shards to handle high throughput. Using a Lambda function to process records from the stream allows real-time anomaly detection. To address concurrency limits, the Lambda concurrency limit can be increased by requesting a limit increase from AWS Support, and you can use reserved concurrency to ensure processing capacity. This solution scales elastically and can meet the 1-minute latency requirement. Option D is incorrect because Kinesis Data Analytics cannot read directly from S3 or from Kinesis Data Firehose; it requires a Kinesis data stream as its source. The architecture in D would not provide real-time processing as it relies on periodic S3 queries.

Answer

Send the IoT messages to an Amazon SQS queue and have Lambda poll the queue in batches to reduce the number of concurrent invocations.

Answer

Store the raw messages in an S3 bucket and use S3 Select to query the data for anomalies periodically.

Answer

Use AWS IoT Core rules to route messages to Amazon Kinesis Data Firehose, which writes raw data to S3. Then use Amazon Kinesis Data Analytics to read from S3 and perform real-time anomaly detection, writing results back to S3 via Firehose.

Question 14

A company is designing a microservices architecture on AWS. Each service needs its own DynamoDB table, and services must be fully isolated. Which networking design ensures that services can only communicate through APIs and not directly to each other's databases?

Accepted Answer

Create a separate VPC for each service, with VPC peering only between the API gateway and each service VPC.. Creating a separate VPC for each service enforces full network isolation, and using VPC peering only between the API Gateway and each service VPC ensures that services can only communicate through APIs. This design prevents any direct network-level access between service databases, as there is no peering or routing between the service VPCs themselves, aligning with the microservices principle of strict isolation.

Answer

Place all services in a single VPC with security groups to control traffic.

Answer

Use a transit VPC with VPN connections to each service's VPC.

Answer

Use a single VPC with public and private subnets; place databases in private subnets and services in public subnets.

Question 15

A company is migrating a legacy application to AWS. The application requires a shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones. The file system must provide high throughput and low latency. Which storage solution meets these requirements?

Accepted Answer

Use Amazon EFS with provisioned throughput.. Amazon EFS with provisioned throughput is the correct choice because it provides a fully managed, scalable, shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones simultaneously. It uses the NFSv4.1 protocol, delivers high throughput and low latency, and allows you to provision throughput independently of storage size to meet performance requirements.

Answer

Use Amazon EBS with a multi-attach enabled volume.

Answer

Use Amazon S3 with S3 File Gateway to present as a file system.

Answer

Use Amazon FSx for Windows File Server with a single file system.