SAP-C02 Design for New Solutions Practice Test 2 — 15 Questions

Question 1

A company is designing a new real-time analytics platform that ingests data from thousands of IoT devices. The devices send JSON messages every second to an AWS IoT Core topic. The messages must be processed and stored in Amazon S3 for long-term analysis. The processing includes enrichment by calling a third-party API to add location data. The company expects the workload to vary significantly, with peak traffic of 100,000 messages per second. The solution must be cost-effective and minimize operational overhead. The current architecture uses a Lambda function subscribed to the IoT topic, which processes each message and writes to S3. However, during initial testing, the Lambda function frequently times out due to the third-party API latency, causing message loss. What should the company do to resolve this issue while meeting all requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the IoT rule to write messages to an Amazon SQS queue. Then use a Lambda function with reserved concurrency to poll the queue and process messages at a controlled rate. Decoupling the ingestion from the processing using an SQS queue allows the Lambda function to poll messages at a controlled rate, preventing timeouts from third-party API latency. The SQS queue acts as a buffer, absorbing traffic spikes of up to 100,000 messages per second, and Lambda can process messages asynchronously without loss. This approach is cost-effective and minimizes operational overhead by leveraging managed services.

Answer

Increase the Lambda function timeout to 15 minutes and memory to 10240 MB

Answer

Use Amazon Kinesis Data Firehose to buffer data and write to S3, then trigger a Lambda function to enrich data asynchronously

Answer

Enable Provisioned Concurrency on the Lambda function to reduce cold starts

Question 2

A company is migrating a monolithic legacy application to a microservices architecture on AWS. The application currently uses a relational database with complex joins. The migration must minimize application changes. Which database strategy should be used for the new architecture?

Accepted Answer

Use a single Amazon RDS instance shared by all microservices.. The requirement to minimize application changes means the microservices must continue to use the same relational database with complex joins. A single shared Amazon RDS instance preserves the existing SQL queries and join logic without requiring data decomposition or API-based data access patterns, which would necessitate significant application rewrites.

Answer

Use a separate Amazon RDS instance for each microservice.

Answer

Use Amazon Aurora with RDS Proxy in front of it.

Answer

Use Amazon DynamoDB as a shared database for all microservices.

Question 3

A solutions architect is designing a new serverless application using AWS Lambda to process orders from an API Gateway endpoint and store them in DynamoDB. The architect creates the IAM role shown in the exhibit. When testing, the Lambda function fails to write to DynamoDB with an AccessDeniedException. What is the MOST likely cause?

Accepted Answer

The IAM role lacks a trust policy that allows Lambda to assume it.. The IAM role shown in the exhibit likely includes a permissions policy that grants DynamoDB write access, but it is missing a trust policy that allows the Lambda service (lambda.amazonaws.com) to assume the role. Without this trust relationship, Lambda cannot obtain temporary credentials to execute the function, resulting in an AccessDeniedException when attempting to write to DynamoDB.

Answer

The Lambda function does not have permission to create log groups.

Answer

The Lambda function is not in the same VPC as DynamoDB.

Answer

The DynamoDB table 'Orders' does not exist.

Question 4

A company is designing a new application that will process sensitive data. The application will run on Amazon ECS with Fargate. The security team requires that all data at rest be encrypted, and that encryption keys be managed by the company's own hardware security module (HSM) in an on-premises data center. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS CloudHSM to generate and store encryption keys. AWS CloudHSM provides dedicated, single-tenant HSM instances that the company can use to generate and store encryption keys in its own HSM, meeting the requirement that keys be managed by the company's own HSM in an on-premises data center (though CloudHSM is in AWS, it is customer-controlled). Option D is correct because creating an AWS KMS custom key store backed by AWS CloudHSM allows the company to use KMS for encryption operations while the key material is stored in the CloudHSM cluster, satisfying the need for customer-managed HSM-backed keys.

Answer

Configure Amazon EBS encryption using AWS KMS with a customer managed key

Answer

Enable Amazon S3 default encryption with SSE-C

Answer

Store encryption keys in AWS Certificate Manager (ACM)

Question 5

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

Accepted Answer

The application is using HTTP instead of HTTPS. The bucket policy likely includes a condition that denies requests not using HTTPS (i.e., `aws:SecureTransport`: false). The application is failing because it is using HTTP instead of HTTPS to access the S3 bucket, which violates the encryption-in-transit requirement enforced by the policy. Without HTTPS, the request is denied by the S3 service.

Answer

The application is not using the VPC endpoint

Answer

The bucket policy does not allow encryption in transit

Answer

The application is missing the required x-amz-server-side-encryption header

Question 6

A company is designing a new web application that will be deployed on AWS. The application consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server. The application must be highly available across multiple Availability Zones. The company expects variable traffic patterns, including sudden spikes. The operations team wants to minimize manual intervention. The application stores session state in a shared data store. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. The company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates. The ALB must terminate SSL/TLS connections. Which combination of actions should the company take to meet these requirements?

Accepted Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using the same ACM certificate. Configure health checks on the target group to use HTTP on port 80 with path /health.. It meets all requirements: the ALB terminates SSL/TLS using an ACM certificate on an HTTPS listener, encrypts traffic between ALB and EC2 instances by using HTTPS on the target group with the same ACM certificate (mutual TLS is not required; the ALB re-encrypts using the same certificate), and uses HTTP health checks on port 80 to avoid certificate validation issues during health checks. This ensures end-to-end encryption, high availability across multiple AZs, and minimizes manual intervention by automating certificate management with ACM.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTP health checks on port 80.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using a self-signed certificate. Configure health checks to use HTTPS on port 443.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS health checks on port 443 using a separate ACM certificate.

Question 7

Match each storage class to its description.

Accepted Answer

S3 Standard: Designed for frequently accessed data with low latency and high throughput.. S3 storage classes cater to different access patterns. Standard for frequent access, Intelligent-Tiering for automatic cost optimization, Standard-IA for infrequent but rapid access, One Zone-IA for lower durability infrequent access, Glacier and Deep Archive for archival with longer retrieval times.

Answer

S3 One Zone-IA: Designed for data that is accessed frequently and requires high durability.

Answer

S3 Glacier: For data that requires immediate access with low latency.

Question 8

Match each AWS security service to its purpose.

Accepted Answer

AWS WAF: Protects web applications from common web exploits. Security services address different aspects of threat protection and access control.

Answer

AWS IAM: Manages encryption keys

Answer

AWS KMS: Manages user identities and permissions

Question 9

A financial services company needs to store sensitive customer data in Amazon S3 with encryption at rest. They require that the encryption keys be stored in AWS CloudHSM and that the S3 bucket must not be able to access the keys without explicit permission. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows the customer to supply their own encryption keys, which can be stored in AWS CloudHSM, and S3 will use those keys to encrypt data at rest. With SSE-C, the customer manages the keys outside of AWS, and S3 cannot access the keys without explicit permission because the keys are provided per request and not stored by AWS. This meets the requirement of storing keys in CloudHSM and ensuring S3 has no independent access to them.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 10

A startup is building a serverless application using AWS Lambda. They need to store session state that can be shared across multiple Lambda invocations. Which AWS service should they use?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides a low-latency, in-memory data store that can be shared across multiple Lambda invocations. Redis supports data structures like strings, hashes, and lists, making it ideal for storing session state that needs to be accessed and updated quickly by concurrent serverless functions.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

Amazon CloudFront

Question 11

A company is migrating a legacy monolithic application to AWS. They want to refactor the application into microservices and use container orchestration. Which AWS service should they use to manage the containers?

Accepted Answer

Amazon EKS. Amazon EKS (Elastic Kubernetes Service) is the correct choice because the company is migrating a legacy monolithic application to microservices and requires container orchestration. EKS provides a managed Kubernetes control plane, which is the industry-standard platform for automating deployment, scaling, and management of containerized applications, making it ideal for refactoring into microservices.

Answer

AWS Lambda

Answer

Amazon ECS

Answer

AWS Fargate

Question 12

A company is designing a new system that will use Amazon S3 to store sensitive data. Which THREE methods can be used to encrypt data at rest in S3?

Accepted Answer

SSE-C. SSE-C (A) is correct because it lets you provide your own encryption keys to S3, which uses them to encrypt objects at rest with AES-256 while you retain full control of the key material. SSE-S3 (C) is correct because S3 manages the encryption keys and applies AES-256 encryption to objects at rest automatically. SSE-KMS (D) is correct because it uses AWS KMS customer master keys (CMKs) to generate and manage the data keys that encrypt objects at rest, adding auditability and granular key control. Client-side encryption (B) is not a server-side S3 at-rest encryption method — data is encrypted before it is sent to S3, so S3 stores only ciphertext and the option is not one of the three S3 at-rest encryption mechanisms. AWS IAM (E) is an access management service for authentication and authorization, not an encryption method, so it does not encrypt data at rest.

Answer

Client-side encryption

Answer

AWS IAM

Question 13

An administrator runs the above commands on an S3 bucket. What is the effect of these configurations on an object uploaded to the bucket?

Accepted Answer

Objects cannot be deleted or overwritten for 365 days unless special permissions are granted.. The configuration shown enables S3 Object Lock in governance mode with a retention period of 365 days. In governance mode, an object cannot be deleted or overwritten until the retention period expires, unless the user has special permissions such as s3:BypassGovernanceRetention. This is why option C is correct: objects cannot be deleted or overwritten for 365 days unless special permissions are granted.

Answer

Objects are locked indefinitely until the lock is manually removed.

Answer

Objects can be deleted immediately because versioning is enabled.

Answer

Objects can be deleted only by the root user.

Question 14

An IAM policy attached to an S3 bucket is shown. What is the net effect on requests to read objects from the bucket?

Accepted Answer

Only requests using HTTPS from the IP range 192.0.2.0/24 are allowed.. The IAM policy includes a Deny statement that blocks all requests unless they use HTTPS and originate from the 192.0.2.0/24 IP range. The Allow statement grants read access to the bucket, but the Deny with a condition (aws:SecureTransport and aws:SourceIp) explicitly overrides the Allow for requests that do not meet both conditions. Therefore, only HTTPS requests from the specified IP range are permitted, making option C correct.

Answer

All HTTPS requests from any IP are allowed.

Answer

Only requests using HTTPS from any IP are allowed because the Deny is overridden.

Answer

All requests from the IP range 192.0.2.0/24 are allowed, regardless of protocol.

Question 15

An administrator runs the above commands and observes the outputs. The instance is in a public subnet with an internet gateway. What is the most likely issue preventing users from accessing the web server?

Accepted Answer

The security group allows HTTP only from the IP range 203.0.113.0/24.. Security groups are stateful: if inbound HTTP traffic is allowed, the corresponding outbound response traffic is automatically allowed, regardless of outbound rules. Therefore, missing outbound rules cannot prevent responses. The most likely issue is that the security group only allows HTTP from the IP range 203.0.113.0/24. Users outside that range will be blocked, even though the instance is in a public subnet with an internet gateway.

Answer

The security group allows SSH from a restricted IP, but not from the users.

Answer

The security group does not allow outbound traffic, so responses cannot be sent.

Answer

The security group does not allow inbound HTTP traffic.