SAP-C02 Design for New Solutions Practice Test 2 — 15 Questions

Question 1

A company has an S3 bucket with server-side encryption using S3-Managed Keys (SSE-S3). The IAM policy shown in the exhibit is attached to a user. When the user attempts to download an object using the AWS CLI with no encryption headers, the request fails. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy condition requires the encryption header in the request.. The IAM policy attached to the user includes a condition that requires the presence of the x-amz-server-side-encryption header in the request, and the header value must match either aws:kms or AES256. When the user issues a download request (GetObject) via the AWS CLI without specifying any encryption header, the condition is not satisfied, and the request is denied. This is a security measure to enforce encryption in transit or to ensure that the client is aware of the encryption, even though the object is encrypted with SSE-S3. Note that for SSE-S3 objects, the x-amz-server-side-encryption header is not required on GET requests by default, but the IAM policy can still require it, causing failure if omitted.

Answer

The object is encrypted with SSE-KMS, not SSE-S3.

Answer

The user does not have the s3:GetObject permission.

Answer

The bucket has a bucket policy that denies all requests.

Question 2

A company is designing a disaster recovery solution for a critical application that runs on Amazon RDS for PostgreSQL. The application requires an RPO of 5 minutes and an RTO of 15 minutes. The primary database is in us-east-1. The recovery Region is us-west-2. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Configure a cross-Region read replica for the RDS PostgreSQL instance in us-west-2.. Both Option B and Option C meet the requirements. Option B: A cross-Region read replica for RDS PostgreSQL can be promoted to a standalone primary in minutes, satisfying the 15-minute RTO, and asynchronous replication typically has lag well under 5 minutes, meeting the 5-minute RPO. Option C: Enabling Multi-AZ ensures high availability within the primary region, but the key component for DR is the read replica in us-west-2. The combination does not prevent meeting the RPO/RTO; the read replica can be promoted quickly. Note that Multi-AZ alone does not provide cross-region DR, but when combined with a cross-Region read replica, it still meets the requirements. Option A: Manual snapshots cannot achieve 5-minute RPO due to snapshot frequency and restore times. Option D: Aurora Global Database is not supported for RDS PostgreSQL; it is for Aurora only. Option E: Automated backups provide daily snapshots, not sub-minute RPO, and cross-region copy adds delay, so RTO is too long.

Answer

Take manual snapshots periodically and copy them to us-west-2.

Answer

Use Amazon Aurora Global Database with a secondary cluster in us-west-2.

Answer

Use automated backups with cross-Region copy to us-west-2.

Question 3

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by third-party APIs. The company plans to use an Application Load Balancer with EC2 instances. Which two steps should the company take to ensure the ALB has a consistent set of IP addresses? (Choose TWO.)

Accepted Answer

Place a Network Load Balancer with Elastic IP addresses in front of the ALB.. AWS Global Accelerator provides two static IP addresses that act as a fixed entry point for traffic, which can be whitelisted by third-party APIs. It routes traffic to the ALB while preserving source IPs. Option B is also correct: placing a Network Load Balancer with Elastic IP addresses in front of the ALB provides static IPs for inbound traffic, as the NLB can be assigned Elastic IPs and forward traffic to the ALB. Option E is incorrect because AWS WAF is a web application firewall that filters traffic but does not affect IP addresses.

Answer

Use a NAT Gateway with Elastic IPs for outbound traffic.

Answer

Use Amazon Route 53 with an A record pointing to the ALB.

Answer

Associate an AWS WAF web ACL with the ALB.

Question 4

A company is deploying a web application on AWS. The application runs on EC2 instances behind an ALB. The security team requires that all traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Which THREE steps should the architect take? (Choose three.)

Accepted Answer

Configure the ALB target group to use HTTPS protocol. To encrypt traffic between the ALB and EC2 instances and restrict instance access to only the ALB, the architect must take two steps. First, configure the ALB target group to use HTTPS protocol (Option C) to encrypt traffic between the ALB and the backend instances. Second, configure the EC2 instance security group to allow inbound traffic only from the ALB's security group (Option D) to restrict access to only the ALB. The ALB listener HTTPS configuration (the null option) is for client-to-ALB encryption, which is not required by the security team's requirement; it is optional if end-to-end encryption is needed, but the question specifically asks for encryption between ALB and instances. Option A (same security group) would allow all traffic between the group members, not restrictive enough. Option B (public subnet) would expose instances directly to the internet. Option E (network ACLs) cannot reference security groups and is stateless, making it unsuitable.

Answer

Assign the same security group to the ALB and the instances

Answer

Place the EC2 instances in a public subnet

Answer

Use network ACLs to restrict inbound traffic to the ALB's IP addresses

Question 5

A company is building a data lake on Amazon S3. The data comes from various sources and must be encrypted at rest. The security policy requires that the encryption keys be managed by the company and rotated annually. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C). Server-side encryption with customer-provided keys (SSE-C) allows the company to provide and manage their own encryption keys, including annual rotation. Server-side encryption with AWS KMS using a customer managed key (SSE-KMS) also lets the company manage keys through KMS and set up automatic annual rotation. Client-side encryption with the Amazon S3 encryption client encrypts data before it is sent to S3, ensuring encryption at rest with keys managed entirely by the company, and the company can rotate the keys as needed. All three options (A, C, and E) meet the requirements for encryption at rest with company-managed keys and annual rotation. Although the stem specifies 'Choose two,' these three are valid; any two can be selected as correct answers.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Enable default encryption on the S3 bucket with SSE-S3

Answer

Use client-side encryption with the Amazon S3 encryption client

Question 6

A company is designing a new application that will use Amazon RDS for PostgreSQL. They need to implement read replicas to offload read traffic. However, they are concerned about replication lag affecting read consistency. Which action would minimize replication lag?

Accepted Answer

Use instance types with higher network performance. Using an instance type with higher network performance (option D) reduces replication lag because it provides more bandwidth for the replication process. Option A (increasing allocated storage) does not directly affect replication lag. Option B (using an encrypted connection) does not impact lag; encryption adds overhead but is necessary for security. Option C (enabling Multi-AZ) is for high availability, not for read replicas.

Answer

Increase the allocated storage on the primary instance

Answer

Use an encrypted connection between the primary and replica

Answer

Enable Multi-AZ on the primary instance

Question 7

A company is designing a new data lake on Amazon S3. The data must be encrypted at rest using envelope encryption with AWS KMS. The company wants to use an AWS managed key that rotates annually. Which TWO components are required for this design? (Choose TWO.)

Accepted Answer

AWS KMS data key. For envelope encryption with an AWS managed key that rotates annually, the required components are the S3 bucket with SSE-KMS enabled to use KMS for encryption at rest, and the AWS KMS data key which is used to encrypt the data before storing. The AWS managed KMS key itself is also required but is not listed as an option; the closest listed component is the customer managed key (Option B), but that does not meet the requirement of using an AWS managed key. Therefore, only options A and E are correct from the given choices.

Answer

AWS KMS customer managed key

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 8

A company has attached the above IAM policy to an IAM role used by an EC2 instance. The EC2 instance is in a VPC with CIDR 10.0.0.0/16 and has a public IP. Which of the following statements is true regarding access to the S3 bucket?

Accepted Answer

The EC2 instance can perform GetObject and PutObject operations only if it uses a VPC endpoint. While the Allow statement grants the necessary S3 actions, the Deny statement includes a condition that blocks all requests that do not originate from a VPC endpoint. Since the EC2 instance has a public IP and traffic does not automatically use a VPC endpoint, only requests made through a VPC endpoint will be allowed. Therefore, the correct statement is D.

Answer

The EC2 instance can perform GetObject and PutObject operations if it uses HTTPS

Answer

The EC2 instance cannot perform any S3 operations because the Deny statement blocks all requests

Answer

The EC2 instance can perform GetObject and PutObject operations from within the VPC

Question 9

A company is designing a multi-region active-active application with a relational database. The application requires strong consistency and read-after-write consistency globally. Which AWS database service should the company choose?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is the only AWS relational database service that can span multiple regions while providing strong consistency within each region. Although it is technically active-passive (single primary writer), it can be used in an active-active pattern for reads by leveraging read replicas in secondary regions. For writes, applications can use write forwarding to send writes from any region to the primary, ensuring strong consistency. DynamoDB Global Tables is NoSQL and provides eventual consistency, not strong. RDS Multi-AZ is single-region. ElastiCache is a cache, not a relational database. Thus, Aurora Global Database best meets the requirements despite its limitations.

Answer

Amazon RDS for MySQL with Multi-AZ

Answer

Amazon DynamoDB Global Tables

Answer

Amazon ElastiCache for Memcached

Question 10

A company is designing a new multi-region application that requires a global database with low-latency reads and writes. The application must be able to survive a regional outage. Which database solution should they choose?

Accepted Answer

Amazon DynamoDB global tables. Amazon DynamoDB global tables provide a fully managed, multi-region, multi-primary database that delivers low-latency reads and writes globally. The service replicates data across multiple AWS Regions automatically, allowing writes to be performed in any region with conflict resolution. In the event of a regional outage, traffic can be directed to another region, ensuring high availability. In contrast, Amazon Aurora Global Database has a single primary region for writes, so writes are not low-latency across regions.

Answer

Amazon RDS Multi-AZ

Answer

Amazon ElastiCache for Redis global datastore

Answer

Amazon Aurora Global Database

Question 11

A company wants to build a serverless backend for a mobile application. The backend provides user authentication, a REST API for data access, and stores data in a NoSQL database. The company expects the application to have unpredictable traffic, and wants to minimize costs. Which solution should a Solutions Architect recommend?

Accepted Answer

Use Amazon Cognito for authentication, API Gateway with Lambda for the API, and Amazon DynamoDB for the database.. The correct choice because it combines Amazon Cognito for user authentication, API Gateway with AWS Lambda for a serverless REST API, and Amazon DynamoDB as a fully managed NoSQL database that scales automatically to handle unpredictable traffic. Option A is incorrect because it uses EC2 instances behind an ALB, which is not serverless and requires ongoing management and costs even when idle. Option C is incorrect because Amazon RDS is a relational database, not NoSQL, and does not match the requirement for a NoSQL database. Option D is incorrect because Amazon S3 is an object storage service, not a database; it is not suitable for transactional data access required by a REST API.

Answer

Use IAM for authentication, EC2 instances behind an ALB for the API, and DynamoDB for the database.

Answer

Use Amazon Cognito for authentication, API Gateway with Lambda for the API, and Amazon RDS for the database.

Answer

Use Amazon Cognito for authentication, API Gateway with Lambda for the API, and Amazon S3 for the database.

Question 12

A company is designing a new application on AWS that will store sensitive user data. The application must comply with data residency requirements, meaning data must remain within a specific geographic region. Which TWO architectural decisions should a Solutions Architect make to ensure compliance?

Accepted Answer

Deploy all resources in a single AWS region that meets the data residency requirement.. The question asks for two architectural decisions, but among the given options, only Option A directly ensures data residency by keeping all resources in a single AWS region that meets the requirement. AWS regions are isolated, and data does not move between regions unless explicitly configured. Option B controls access via S3 bucket policies but does not guarantee data stays in the region. Option C uses CloudFront edge locations, which may cache data globally, violating residency. Option D (KMS) handles encryption keys, not data location. Option E (cross-region replication) explicitly moves data to another region, violating residency. A common second correct decision would be using AWS Organizations service control policies (SCPs) to restrict resource creation to the required region, but this is not listed. Therefore, only Option A is correct for the available choices.

Answer

Use Amazon CloudFront to serve content from edge locations.

Answer

Use AWS Key Management Service (KMS) with customer managed keys.

Answer

Enable cross-Region replication for data stored in Amazon S3.

Question 13

A company wants to migrate a monolithic application to AWS and redesign it using microservices. The application uses a MySQL database. The company wants to minimize operational overhead and enable each microservice to have its own database. Which AWS service should the company use to implement the database layer?

Accepted Answer

Amazon RDS for MySQL. Amazon RDS for MySQL is the correct choice because it provides a managed MySQL database service that minimizes operational overhead through automated backups, patching, and scaling. Each microservice can have its own RDS instance, enabling database-per-service isolation while offloading administrative tasks like replication and failover to AWS.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon Aurora

Question 14

A company is designing a serverless application using AWS Lambda functions. The application processes events from an Amazon SQS queue. The company wants to ensure that the Lambda function can scale to handle a sudden increase in messages without losing any messages. The Lambda function must process each message at least once. Which configuration should the company use?

Accepted Answer

Configure the SQS queue as a Lambda event source with a reserved concurrency of 1000 for the Lambda function.. Configuring the SQS queue as a Lambda event source with a reserved concurrency of 1000 ensures that Lambda can scale up to 1000 concurrent executions to handle a sudden burst of messages. The SQS event source uses long polling and synchronously invokes Lambda, which processes messages in batches and automatically deletes them from the queue only upon successful completion, guaranteeing at-least-once processing. Reserved concurrency prevents throttling and ensures that the function has sufficient capacity to scale without losing messages.

Answer

Configure the SQS queue to invoke the Lambda function asynchronously and set the Lambda function timeout to 5 minutes.

Answer

Set the SQS queue visibility timeout to 30 seconds and the Lambda batch size to 100. Configure a dead-letter queue for failed messages.

Answer

Use an SQS FIFO queue with a Lambda function that has a reserved concurrency of 1.

Question 15

A company is designing a multi-account AWS environment using AWS Organizations. The company has several business units that each require their own VPC in shared accounts managed centrally. The company wants to enable VPC sharing to allow business units to create resources in shared subnets while maintaining network isolation. Which combination of steps should the company take to achieve this? (Choose TWO.)

Accepted Answer

Create a resource share in AWS Resource Access Manager (RAM) for the shared VPC subnets.. AWS Resource Access Manager (RAM) allows you to share subnets from a centrally owned VPC with other AWS accounts within your AWS Organization. This enables business units to launch resources directly into the shared subnets while the VPC and its networking configuration remain managed centrally. Option B is correct because attaching a transit gateway to the shared VPC and to each business unit's VPC provides the necessary network connectivity between the shared VPC and the business unit VPCs, allowing traffic to flow while maintaining isolation through separate route tables and security group boundaries. Together, these steps enable both resource sharing in the shared subnets and network connectivity with isolation.

Answer

Configure VPC endpoints in each business unit VPC to access the shared VPC.

Answer

Create VPC peering connections between the shared VPC and each business unit's VPC.

Answer

Use AWS PrivateLink to connect the business unit VPCs to the shared VPC.