SAP-C02 Design for New Solutions Practice Test 19 — 15 Questions

Question 1

A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager is designed for storing and rotating secrets centrally. Option A: Systems Manager Parameter Store can store secrets but does not natively rotate them. Option C: KMS is for encryption keys, not secret storage. Option D: CloudHSM is for hardware security modules.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 2

A company is building a new microservices architecture on AWS using Amazon ECS with Fargate. The services need to communicate with each other using RESTful APIs. The company wants to implement an API gateway to handle authentication, rate limiting, and request routing. Which AWS service should be used as the API gateway?

Accepted Answer

Amazon API Gateway. Option C is correct because Amazon API Gateway provides authentication, rate limiting, and request routing for RESTful APIs. Option A: ALB is a load balancer, not an API gateway. Option B: CloudFront is a CDN. Option D: NLB is for TCP/UDP traffic.

Answer

Network Load Balancer

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 3

A company is migrating a legacy on-premises application to AWS. The application uses a monolithic architecture and a MySQL database. The company wants to refactor the application into microservices and use a NoSQL database for better scalability. The new application will be deployed on Amazon EKS. The database must be highly available and support automatic scaling. Which database service should the company use?

Accepted Answer

Amazon DynamoDB. Option D is correct because Amazon DynamoDB is a NoSQL database that supports high availability and automatic scaling. Option A: RDS for MySQL is relational, not NoSQL. Option B: Aurora is relational. Option C: DocumentDB is NoSQL but is MongoDB-compatible; DynamoDB is more fully managed and serverless.

Answer

Amazon Aurora Serverless

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon RDS for MySQL with Multi-AZ deployment

Question 4

A company is building a new application that will run on AWS Lambda. The application needs to store and retrieve user preferences in a key-value format. The data is accessed frequently and must be highly available. The company expects low latency for reads and writes. Which AWS service should be used as the data store?

Accepted Answer

Amazon DynamoDB. Option B is correct because Amazon DynamoDB is a key-value store designed for low-latency, high-availability access. Option A: S3 is object storage, not key-value. Option C: RDS is relational. Option D: ElastiCache is in-memory but not persistent by default.

Answer

Amazon S3

Answer

Amazon ElastiCache for Memcached

Answer

Amazon RDS for PostgreSQL

Question 5

A company is deploying a new web application that uses Amazon S3 to store static content and Amazon CloudFront for content delivery. The application also uses an API Gateway with Lambda for backend logic. The company wants to protect the API from common web exploits like SQL injection and cross-site scripting. Which AWS service should be added to the architecture?

Accepted Answer

AWS WAF. Option B is correct because AWS WAF integrates with API Gateway and CloudFront to protect against web exploits. Option A: Shield Advanced provides DDoS protection, not application-layer filtering. Option C: GuardDuty is for threat detection, not inline protection. Option D: Inspector is for vulnerability assessment.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Shield Advanced

Question 6

A company is designing a new data lake on AWS. The data lake will store structured and unstructured data from various sources. The company needs a solution that can automatically catalog the data and make it searchable. Data will be stored in Amazon S3. Which AWS service should be used to catalog and enable search across the data lake?

Accepted Answer

AWS Glue Data Catalog. Option A is correct because AWS Glue provides a data catalog that automatically discovers and catalogs metadata from S3. Option B: Athena is a query engine, not a catalog. Option C: EMR is for big data processing. Option D: Redshift Spectrum queries data in S3 but does not catalog it.

Answer

Amazon Athena

Answer

Amazon EMR

Answer

Amazon Redshift Spectrum

Question 7

A company is designing a new application that will run on Amazon EC2 instances. The application needs to access an Amazon S3 bucket to read and write objects. The company wants to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. Which TWO steps should the company take?

Accepted Answer

Attach the IAM role to the EC2 instance profile.. Option A and Option D are correct. An IAM role with an S3 policy is attached to the EC2 instance profile, allowing the instance to assume the role and access S3 without credentials. Option B: Access keys should not be stored on instances. Option C: S3 bucket policy can be used but is not required if the IAM role grants access. Option E: Security groups do not apply to S3 access.

Answer

Store the AWS access key and secret access key in a configuration file on the instance.

Answer

Create an S3 bucket policy that allows access from the EC2 instance's IP address.

Answer

Configure the EC2 security group to allow outbound traffic to S3.

Question 8

A company is designing a new application that will run on Amazon ECS with Fargate. The application must process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. The workload is unpredictable and can scale from 0 to thousands of messages per second. What is the MOST cost-effective and scalable architecture?

Accepted Answer

Use an AWS Lambda function with an SQS trigger to process messages and write to DynamoDB.. Option C is correct because using a Lambda function to poll the SQS queue and write to DynamoDB is serverless, scales automatically, and is cost-effective for unpredictable workloads. Option A is wrong because provisioning EC2 instances for ECS with Fargate still incurs costs even when idle. Option B is wrong because ECS with Fargate services require at least one running task, which may be idle. Option D is wrong because Kinesis Data Streams is designed for real-time streaming, not for standard message queuing, and may be more expensive.

Answer

Run an Amazon ECS service with Fargate that polls the SQS queue and writes to DynamoDB. Configure auto scaling based on CPU utilization.

Answer

Use an Amazon ECS service with Fargate and a target tracking scaling policy based on SQS queue depth.

Answer

Use Amazon Kinesis Data Streams to ingest messages and an AWS Lambda function to process and write to DynamoDB.

Question 9

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in two AWS Regions. The company needs to ensure that if one region becomes unavailable, traffic is automatically routed to the healthy region with minimal disruption. Which configuration meets these requirements?

Accepted Answer

Configure Route 53 latency-based routing with health checks attached to each ALB endpoint.. Option B is correct because Route 53 health checks can monitor ALB endpoints. When a health check fails, Route 53 removes the unhealthy endpoint from latency-based routing, directing traffic to the healthy region. Option A is wrong because latency-based routing alone does not failover. Option C is wrong because failover routing requires a primary/secondary setup, not active-active. Option D is wrong because weighted routing does not automatically failover based on health.

Answer

Use Route 53 failover routing instead of latency-based routing.

Answer

Configure Route 53 latency-based routing without health checks.

Answer

Use Route 53 weighted routing with weights set to 50 for each region.

Question 10

A company is designing a new solution to store and analyze large amounts of log data from multiple sources. The logs must be retained for 90 days for recent analysis, and then archived to a more cost-effective storage class for an additional 5 years. The solution must support SQL-based queries. Which combination of AWS services should the company use?

Accepted Answer

Amazon S3 with lifecycle policies to transition objects to S3 Glacier Deep Archive after 90 days, and Amazon Athena for SQL queries.. Option A is correct because Amazon S3 can store logs with lifecycle policies to transition to S3 Glacier Deep Archive, and Amazon Athena can run SQL queries directly on S3. Option B is wrong because Amazon RDS is not cost-effective for large-scale log storage and querying. Option C is wrong because Amazon Redshift is optimized for data warehousing, not for simple log storage and querying, and may be overkill. Option D is wrong because Amazon OpenSearch Service is not SQL-based natively, and its storage costs are higher.

Answer

Amazon Redshift with data sharing to retain logs for 5 years.

Answer

Amazon OpenSearch Service with UltraWarm storage to archive logs after 90 days.

Answer

Amazon RDS for PostgreSQL with automated backups to retain logs for 5 years.

Question 11

A company is designing a serverless application using AWS Lambda that needs to access a private Amazon RDS for MySQL database. The Lambda function is deployed in a VPC with the appropriate security groups. The database is in a private subnet. The company wants to avoid storing database credentials in the Lambda function code. What should the company do to securely access the database?

Accepted Answer

Store the database credentials in AWS Secrets Manager and retrieve them using the Secrets Manager API in the Lambda function.. Option C is correct because AWS Secrets Manager can securely store database credentials and Lambda can retrieve them via the Secrets Manager API. Option A is wrong because IAM roles cannot be used directly for MySQL database authentication. Option B is wrong because Systems Manager Parameter Store can store credentials but Secrets Manager is better suited for secrets rotation. Option D is wrong because environment variables are not secure.

Answer

Create an IAM role that allows Lambda to access the RDS instance using IAM database authentication.

Answer

Pass the database credentials as environment variables to the Lambda function.

Answer

Store the database credentials in AWS Systems Manager Parameter Store and retrieve them in the Lambda function.

Question 12

A company is designing a new data lake on Amazon S3. The data is ingested from various sources and must be encrypted at rest. The company has a strict requirement to use an AWS KMS customer master key (CMK) that is stored in a different AWS account for additional security. The S3 bucket is in Account A, and the KMS key is in Account B. Which steps are necessary to enable server-side encryption with AWS KMS (SSE-KMS) for objects in the S3 bucket?

Accepted Answer

Update the KMS key policy in Account B to grant Account A access to the key, and update the S3 bucket policy in Account A to allow the kms:Encrypt and kms:Decrypt actions for the key.. Option D is correct because cross-account KMS access requires both a key policy in Account B granting Account A permission to use the key, and an S3 bucket policy in Account A that allows the necessary actions and specifies the KMS key. Option A is wrong because the KMS key policy must allow Account A to use the key, but the S3 bucket policy also needs to be updated. Option B is wrong because the KMS key policy must explicitly grant access to Account A. Option C is wrong because S3 does not automatically use the KMS key; the bucket policy must specify the key.

Answer

Enable SSE-KMS on the S3 bucket in Account A and specify the ARN of the KMS key from Account B. S3 will automatically use the key.

Answer

Update the KMS key policy in Account B to grant Account A access to the key. No changes needed in Account A.

Answer

Update the S3 bucket policy in Account A to allow s3:PutObject with the kms:Encrypt permission. No changes needed in Account B.

Question 13

A company is designing a highly available web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to EC2 instances in an Auto Scaling group across multiple Availability Zones. The application state is stored in an Amazon ElastiCache for Redis cluster. The company wants to minimize downtime during patching of the Redis cluster. What should the company do?

Accepted Answer

Deploy the Redis cluster with Multi-AZ and automatic failover enabled across two Availability Zones.. Option A is correct because deploying ElastiCache for Redis with Multi-AZ with automatic failover allows the cluster to continue operating during maintenance. Option B is wrong because a single node cluster will be unavailable during patching. Option C is wrong because ElastiCache does not support blue/green deployment. Option D is wrong because increasing the node type does not eliminate downtime during patching.

Answer

Increase the Redis node type to handle the load and rely on the ElastiCache maintenance window.

Answer

Use a blue/green deployment strategy by creating a new Redis cluster and switching the application endpoint.

Answer

Deploy the Redis cluster as a single node in one Availability Zone and take regular snapshots.

Question 14

A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?

Accepted Answer

AWS Cloud Map with namespaces and service instances.. Option C is correct because AWS Cloud Map provides service discovery for ECS services, allowing them to register and discover each other via DNS or API calls. Option A is wrong because Route 53 private hosted zones can be used but Cloud Map is specifically designed for service discovery. Option B is wrong because ELB is for load balancing, not service discovery. Option D is wrong because VPC endpoints are for accessing AWS services privately, not for service discovery.

Answer

AWS PrivateLink with VPC endpoint services.

Answer

Amazon Route 53 private hosted zones with DNS records for each service.

Answer

Elastic Load Balancing with internal load balancers for each service.

Question 15

A company is designing a new application that will use Amazon DynamoDB as its primary database. The application has two access patterns: one requires strongly consistent reads, and the other requires eventually consistent reads. The company wants to minimize costs while meeting the read consistency requirements. How should the company configure DynamoDB reads?

Accepted Answer

Use strongly consistent reads for the pattern that requires it, and eventually consistent reads for the other pattern.. Option B is correct because DynamoDB offers both strongly consistent and eventually consistent reads. Eventually consistent reads are half the cost of strongly consistent reads. The application should use strongly consistent reads only when needed. Option A is wrong because using strongly consistent reads for all patterns is more expensive. Option C is wrong because DynamoDB Accelerator (DAX) is for caching, not for consistency. Option D is wrong because there is no option to use both; you choose per request.

Answer

Use strongly consistent reads for all read requests to ensure data accuracy.

Answer

Use DynamoDB Accelerator (DAX) to cache reads and achieve strong consistency.

Answer

Use DynamoDB global tables with strongly consistent reads enabled.