SAP-C02 Design for New Solutions Practice Test 19 — 15 Questions

Question 1

A company is designing a new application that will use Amazon S3 to store sensitive data. The company must ensure that data is encrypted at rest and in transit, and that access is audited. The security team requires that encryption keys be managed by the company and rotated automatically. Which two actions should be taken to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the S3 bucket policy to require requests to use SSL/TLS (aws:SecureTransport condition).. To meet the requirements, the company must use AWS KMS customer managed keys for encryption at rest with automatic rotation, and enforce SSL/TLS for encryption in transit. These two actions ensure that data is encrypted both at rest and in transit, with company-managed keys. Auditing is handled separately and is not part of the encryption requirements.

Answer

Enable S3 server access logging to a separate bucket and enable AWS CloudTrail data events for the S3 bucket.

Answer

Use S3 managed encryption keys (SSE-S3) for default encryption.

Answer

Enable versioning on the S3 bucket to protect against accidental deletion.

Question 2

A healthcare company is migrating a legacy on-premises application to AWS. The application stores sensitive patient data and must comply with HIPAA. The company requires that all data at rest be encrypted with customer-managed keys, and that the encryption keys be rotated annually. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The data is stored in an Amazon RDS for MySQL database and an Amazon S3 bucket. The security team wants to use AWS KMS to manage the keys and ensure that only the EC2 instances and RDS can use the keys. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create a customer-managed KMS key with automatic rotation enabled. Use the key to encrypt the RDS database and the S3 bucket. Attach a key policy that allows the EC2 instance role and the RDS service to use the key.. A single customer-managed KMS key with automatic rotation meets the annual rotation requirement and centralizes management. The key policy must explicitly allow the EC2 instance role and the RDS service to use the key, ensuring least privilege. This solution minimizes operational overhead by reducing the number of keys to manage while still meeting compliance.

Answer

Create a customer-managed KMS key for RDS and another for S3. Enable automatic rotation on both keys. Use IAM policies to grant the EC2 instance role and RDS access to the keys.

Answer

Use AWS-managed KMS keys for RDS and S3. Enable automatic rotation. Use IAM policies to restrict access to the EC2 instance role and RDS.

Answer

Create a customer-managed KMS key with automatic rotation enabled. Use the key to encrypt the RDS database and the S3 bucket. Use an IAM policy to allow the EC2 instance role and RDS to use the key, and rely on the default key policy.

Question 3

A healthcare company is migrating a legacy on-premises application to AWS. The application uses a monolithic architecture and a Microsoft SQL Server database. The company requires a disaster recovery (DR) strategy with an RPO of 15 minutes and an RTO of 2 hours. The solution must be cost-effective and minimize operational overhead. Which DR strategy should a solutions architect recommend?

Accepted Answer

Use a warm standby strategy with a scaled-down version of the application on EC2 and a SQL Server Always On availability group with an asynchronous replica in another AWS Region.. The warm standby strategy with SQL Server Always On asynchronous replication meets the RPO of 15 minutes and RTO of 2 hours. It is cost-effective compared to active-active and provides a functional standby that can be quickly scaled up. This approach minimizes operational overhead by using managed features of SQL Server on EC2.

Answer

Deploy a multi-site active-active configuration with the application running in two AWS Regions and SQL Server using peer-to-peer replication.

Answer

Implement a pilot light strategy with a small EC2 instance running SQL Server Express and use AWS Database Migration Service (AWS DMS) for continuous replication.

Answer

Use a backup and restore strategy with daily snapshots of Amazon EBS volumes and SQL Server native backups to Amazon S3, replicated to another Region.

Question 4

A company is designing a new data processing pipeline that uses AWS Lambda functions triggered by Amazon S3 events. The pipeline must process each object exactly once and in the order they were uploaded. The company expects a high volume of uploads and cannot tolerate duplicate processing. Which solution should be used?

Accepted Answer

Configure the S3 bucket to send event notifications to an Amazon SQS FIFO queue, and have the Lambda function poll the queue.. To achieve exactly-once and ordered processing of S3 events, the events must be routed through a mechanism that supports FIFO and deduplication. An SQS FIFO queue provides both, and Lambda's integration with SQS FIFO ensures that messages are processed in order and only once, as long as the function completes successfully. Direct Lambda invocation, SNS, and EventBridge do not offer these guarantees, making the SQS FIFO approach the correct choice.

Answer

Configure the S3 bucket to send event notifications to an Amazon EventBridge rule, and route events to a Lambda function with an AWS Step Functions state machine for orchestration.

Answer

Configure the S3 bucket to send event notifications directly to the Lambda function, and enable reserved concurrency to limit parallel executions.

Answer

Configure the S3 bucket to send event notifications to an Amazon SNS topic, and subscribe a Lambda function to the topic with a dead-letter queue.

Question 5

A company is designing a new application that will use Amazon S3 to store sensitive data. The company must ensure that data is encrypted at rest and in transit, and that access is audited. The security team requires that encryption keys be managed by the company and rotated automatically. Which two actions should be taken to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 Standard-Infrequent Access (S3 Standard-IA). The data is infrequently accessed but requires quick retrieval (minutes). S3 Standard-IA provides lower storage costs than S3 Standard while maintaining high durability and availability, and it offers millisecond access. It is specifically designed for this use case. Other classes either cost more, add monitoring fees, or have retrieval times that are too long.

Answer

S3 Glacier Deep Archive

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Question 6

A company is designing a new application that will use Amazon S3 to store sensitive data. The company must ensure that data is encrypted at rest and in transit, and that access is audited. The security team requires that encryption keys be managed by the company and rotated automatically. Which two actions should be taken to meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Lambda function with a memory size of 1024 MB and a timeout of 15 minutes.. AWS Lambda allows a maximum timeout of 15 minutes, so the function must be configured with that timeout to handle 10-minute processing. A memory size of 1024 MB provides sufficient CPU and network for large file processing without excessive cost. Other options either have insufficient memory or timeout, or add unnecessary complexity.

Answer

Configure the Lambda function with a memory size of 3008 MB and a timeout of 15 minutes, and enable provisioned concurrency.

Answer

Configure the Lambda function with a memory size of 512 MB and a timeout of 5 minutes, and use AWS Step Functions to orchestrate multiple Lambda invocations.

Answer

Configure the Lambda function with a memory size of 128 MB and a timeout of 15 minutes.

Question 7

A company is migrating a monolithic on-premises application to AWS. The application consists of a web tier and a database tier. The company wants to improve scalability and reduce operational overhead. They decide to refactor the application into microservices. The new architecture will use Amazon ECS with AWS Fargate for compute, and an Application Load Balancer (ALB) for routing. The services need to communicate with each other. The company wants to minimize latency and avoid managing additional infrastructure. Which service should be used for service-to-service communication?

Accepted Answer

AWS Cloud Map with Amazon ECS Service Connect.. Amazon ECS Service Connect is designed for service-to-service communication in ECS. It provides service discovery, load balancing, and observability without requiring you to manage additional infrastructure. It uses Cloud Map for discovery and a lightweight proxy managed by ECS, reducing latency and operational overhead. This meets the requirements.

Answer

ALB with multiple target groups and path-based routing.

Answer

AWS App Mesh with Envoy proxies.

Answer

Amazon ECS Service Discovery with AWS Cloud Map.

Question 8

A company is designing a new serverless application that processes events from an Amazon Kinesis Data Stream. The application uses AWS Lambda functions to process the events and write results to an Amazon DynamoDB table. The company expects the event volume to vary significantly, with occasional spikes. The solutions architect must ensure that the Lambda function can scale to handle the spikes without overwhelming the downstream DynamoDB table, and that events are processed in order for each partition key. Which two actions should the solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Set the Lambda function's reserved concurrency to a value that limits the number of concurrent invocations to a level that DynamoDB can handle.. Setting reserved concurrency on the Lambda function limits the number of concurrent invocations, which controls how many shards are processed simultaneously and prevents overwhelming DynamoDB. Enabling DynamoDB auto scaling allows the table to automatically adjust its write capacity to handle the increased load during spikes, ensuring that the table can keep up with the processing rate without manual intervention.

Answer

Configure the Lambda function's event source mapping with a batch size of 100 and a maximum batching window of 10 seconds.

Answer

Configure the Lambda function to use a dead-letter queue (DLQ) to capture failed events and retry them later.

Answer

Increase the number of shards in the Kinesis Data Stream to allow more concurrent Lambda invocations.

Question 9

A media company is designing a new video-transcoding pipeline. Source videos are uploaded to Amazon S3, and the pipeline must process each file exactly once, retry failed jobs, and coordinate multiple steps that run for up to 4 hours each. The company wants a fully managed service that provides execution history and visual monitoring of each step. Which AWS service should a solutions architect recommend?

Accepted Answer

AWS Step Functions with a Standard workflow that invokes AWS Elemental MediaConvert jobs and uses a task token for callback patterns.. AWS Step Functions Standard workflows are designed for long-running, multi-step orchestration with built-in retries, execution history, and visual monitoring. The callback pattern with task tokens lets a workflow pause while AWS Elemental MediaConvert transcodes a file and resume when the job completes, which fits steps lasting up to 4 hours. This provides exactly-once processing and reliable coordination.

Answer

AWS Glue workflows with triggers that start AWS Glue jobs for each transcoding step.

Answer

Amazon EventBridge with rules that route S3 events to AWS Elemental MediaConvert and AWS Lambda for status updates.

Answer

AWS Lambda with S3 event notifications and Amazon SQS as a dead-letter queue.

Question 10

A company is designing a new hybrid architecture that connects its on-premises data center to AWS. The company needs to transfer large volumes of data nightly to Amazon S3 for backup, and also requires low-latency, consistent network performance for its critical applications. The company wants a solution that is cost-effective and can be set up quickly. Which combination of AWS services should the solutions architect recommend?

Accepted Answer

Use AWS Direct Connect with a public virtual interface for backups and a private virtual interface for critical applications.. AWS Direct Connect provides dedicated, consistent network performance, which is essential for critical applications. Using a public virtual interface for S3 backups and a private virtual interface for VPC access separates traffic types and meets both requirements. This solution is cost-effective for high-volume data transfer and can be deployed quickly. Other options either rely on the internet or add unnecessary complexity.

Answer

Use AWS Site-to-Site VPN for the critical applications and AWS DataSync for nightly backups.

Answer

Use AWS Site-to-Site VPN with accelerated VPN for both critical applications and backups.

Answer

Use AWS Direct Connect with a transit virtual interface to connect to a AWS Transit Gateway, and use AWS DataSync for backups.

Question 11

A financial services company is deploying a new multi-tier web application on AWS. The application runs on Amazon EC2 instances in private subnets across three Availability Zones. A security policy mandates that all data at rest and in transit must be encrypted, and that encryption keys must be rotated annually. The company wants to minimize operational overhead while meeting these requirements. Which solution should a solutions architect recommend?

Accepted Answer

Use AWS Key Management Service (KMS) customer managed keys with automatic annual rotation enabled. Configure Amazon EBS encryption using these keys, and enforce TLS for all application traffic with certificates from AWS Certificate Manager (ACM).. The requirement for annual key rotation with minimal operational overhead is best met by AWS KMS customer managed keys, which support automatic annual rotation. EBS encryption using these keys secures data at rest, and ACM provides automatically renewed TLS certificates for data in transit. This integrated approach leverages AWS managed services to reduce administrative tasks while ensuring compliance.

Answer

Use AWS KMS AWS managed keys for EBS encryption and store TLS private keys in AWS Secrets Manager, rotating them manually every year using a custom Lambda function.

Answer

Use AWS CloudHSM to generate and manage encryption keys for EBS volumes, and use AWS Certificate Manager Private Certificate Authority (ACM PCA) for TLS certificates.

Answer

Encrypt EBS volumes using a customer managed KMS key with manual rotation, and use self-signed certificates on the EC2 instances for TLS termination.

Question 12

A company is deploying a critical application on AWS that uses an Application Load Balancer (ALB) to distribute traffic to Amazon EC2 instances in multiple Availability Zones. The application must be highly available and able to withstand the failure of an entire Availability Zone. The company also requires that the application be accessible via a custom domain name with a static IP address. Which solution should a solutions architect recommend to meet these requirements?

Accepted Answer

Use an Application Load Balancer with an AWS Global Accelerator endpoint. Configure the Global Accelerator to use the ALB as an endpoint in multiple Availability Zones.. AWS Global Accelerator provides static Anycast IP addresses that are globally accessible and can route traffic to an Application Load Balancer in multiple Availability Zones. This ensures high availability and fault tolerance, as Global Accelerator automatically fails over to healthy endpoints if an Availability Zone becomes unavailable. The static IPs satisfy the custom domain requirement.

Answer

Use a Network Load Balancer (NLB) with an Elastic IP address. Configure the NLB to route traffic to the EC2 instances in multiple Availability Zones.

Answer

Use an Application Load Balancer with an Amazon Route 53 latency-based routing policy. Create A records for the ALB in each Availability Zone.

Answer

Use a Network Load Balancer with a TLS listener and an AWS Global Accelerator endpoint. Configure the Global Accelerator to use the NLB as an endpoint.

Question 13

A media company is designing a new video-on-demand platform in a single AWS Region. Metadata for each title must be stored with millisecond read latency, and the same metadata table must be read simultaneously from three VPCs that are each attached to a different AWS Transit Gateway. The company also requires that the table survive the loss of one Availability Zone without any manual intervention. Which storage design should the solutions architect choose?

Accepted Answer

An Amazon DynamoDB table with on-demand capacity mode and a global secondary index, accessed through a VPC gateway endpoint from each VPC.. The requirement is a durable, Multi-AZ key-value store with low-latency point reads reachable privately from several VPCs. DynamoDB automatically replicates across three Availability Zones in the Region and exposes a gateway endpoint that each VPC can use, avoiding internet egress and NAT costs. On-demand capacity also absorbs unpredictable read traffic without pre-provisioned throughput planning.

Answer

An Amazon ElastiCache for Redis cluster in cluster mode enabled, with automatic failover and AUTH enabled, shared by all three VPCs.

Answer

An Amazon Aurora MySQL cluster with a single writer instance and two reader instances, fronted by an Aurora custom endpoint that all three VPCs query.

Answer

An Amazon S3 bucket with S3 Standard storage class and a bucket policy that grants read access to all three VPCs through an S3 interface endpoint.

Question 14

A company is building a real-time analytics platform that ingests clickstream data from millions of users. The data must be stored durably for at least one year and be immediately queryable by a fleet of Amazon EC2 instances using standard SQL. The query patterns are unpredictable and may involve full scans of large datasets. The company wants to minimize operational overhead and storage costs. Which solution meets these requirements?

Accepted Answer

Ingest the data into Amazon Kinesis Data Streams, then use AWS Lambda to write the data into Amazon Aurora Serverless v2. Query the data using standard SQL from the EC2 instances.. Amazon Aurora Serverless v2 provides a relational database with standard SQL support, automatic scaling, and high durability. It allows EC2 instances to connect using standard MySQL drivers and execute complex queries. It reduces operational overhead by scaling capacity automatically, and it can store data for the required retention period, making it suitable for this real-time analytics platform.

Answer

Ingest the data into Amazon Kinesis Data Streams, then use AWS Lambda to transform and load the data into Amazon S3. Use Amazon Athena to query the data directly from S3.

Answer

Ingest the data into Amazon Kinesis Data Firehose, which delivers it to Amazon S3. Use Amazon Athena to query the data, and connect to Athena from the EC2 instances using the JDBC driver.

Answer

Ingest the data into Amazon Kinesis Data Firehose, which delivers it to an Amazon Redshift cluster. Use Amazon Redshift Spectrum to query data in S3 for full scans.

Question 15

A solutions architect is designing a new application that will store sensitive data in Amazon S3. The data must be encrypted at rest. The company wants to use AWS Key Management Service (KMS) for key management and requires that the encryption keys are rotated automatically every year. The company also needs to audit the use of the keys. Which two actions should the solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Create a customer managed key in AWS KMS and enable automatic key rotation.. To meet the requirements, the architect should use a customer managed key in AWS KMS with automatic rotation enabled, because it supports annual rotation and provides control and auditability. Additionally, enabling AWS CloudTrail logging for KMS captures all key usage, which can be stored and analyzed for auditing. AWS managed keys do not support yearly rotation, and other options do not provide the necessary KMS integration or auditing.

Answer

Store the encryption keys in AWS Secrets Manager and configure automatic rotation every 30 days.

Answer

Use server-side encryption with Amazon S3 managed keys (SSE-S3) and enable S3 server access logging.

Answer

Use an AWS managed key for Amazon S3 (aws/s3) and rely on its automatic rotation.