SAP-C02 Design for New Solutions Practice Test 20 — 15 Questions

Question 1

A media company is building a new transcoding pipeline on AWS. Source video files are uploaded to an Amazon S3 bucket in the us-east-1 Region, and the company wants to automatically start an AWS Step Functions workflow for each upload. The workflow must process each file exactly once and must tolerate occasional throttling from downstream services. The solution must require the least operational overhead. Which combination of services should be used to trigger the workflow?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Amazon EventBridge rule that matches S3 PutObject events and targets the Step Functions workflow directly.. Amazon EventBridge can receive S3 events when EventBridge notifications are enabled on the bucket, and it can directly target AWS Step Functions. This native integration eliminates the need for custom polling or intermediary compute, reducing operational overhead. The workflow can be configured with retries to handle downstream throttling, ensuring each file is processed exactly once.

Answer

Configure an S3 event notification to send messages to an Amazon SQS FIFO queue, and have a poller AWS Lambda function start the Step Functions workflow.

Answer

Create an AWS Lambda function that is invoked by S3 event notifications and calls the Step Functions StartExecution API.

Answer

Enable S3 EventBridge notifications and configure an EventBridge rule to send events to an Amazon SNS topic, which then triggers the Step Functions workflow.

Question 2

A company is deploying a new containerized application on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The application consists of multiple microservices that communicate with each other over HTTP. The company wants to ensure that each microservice can be independently scaled and that traffic is distributed evenly across tasks. The solution must minimize operational overhead and integrate with AWS Identity and Access Management (IAM) for authentication. What should a solutions architect recommend?

Accepted Answer

Use an Application Load Balancer with dynamic port mapping and service discovery via AWS Cloud Map.. The recommended approach is to use an Application Load Balancer with dynamic port mapping and AWS Cloud Map for service discovery. This allows each microservice to scale independently, distributes traffic evenly across tasks, and integrates with IAM for authentication. It also minimizes operational overhead because Fargate manages the underlying infrastructure. Other options either increase operational overhead or do not provide the required features.

Answer

Deploy the microservices on EC2 instances with the Amazon ECS-optimized AMI and use an Application Load Balancer with path-based routing.

Answer

Use AWS App Mesh with an Envoy proxy sidecar for each task and configure virtual nodes and virtual services.

Answer

Create a Network Load Balancer for each microservice and configure static IP addresses for the tasks.

Question 3

A company is designing a new serverless application that processes files uploaded to an Amazon S3 bucket. The application uses an AWS Lambda function to process each file. The processing time varies from a few seconds to several minutes, and the company wants to ensure that files are processed in the order they are uploaded. The company also wants to minimize the number of failed invocations due to timeouts. Which solution should a solutions architect recommend?

Accepted Answer

Configure the S3 bucket to send events to an Amazon SQS FIFO queue, and have the Lambda function poll the queue.. Using an SQS FIFO queue between S3 and Lambda ensures that events are processed in the order they are received. S3 can send event notifications to an SQS queue. Lambda polls the queue and processes messages in order. This decouples the processing, allowing Lambda to handle longer processing times without S3 event timeouts, and provides retry mechanisms.

Answer

Enable S3 Transfer Acceleration and invoke the Lambda function synchronously.

Answer

Use an Amazon S3 event notification to trigger an AWS Step Functions state machine that invokes the Lambda function.

Answer

Configure the S3 bucket to invoke the Lambda function directly on object creation events.

Question 4

A financial services company is migrating a legacy on-premises Oracle database to AWS. The database must remain highly available with an RPO of less than 5 seconds and an RTO of under 2 minutes. The company needs the ability to fail over to a different AWS Region in the event of a regional outage. The database currently uses Oracle Data Guard for replication. The company wants to minimize licensing costs and operational overhead. Which solution should a solutions architect recommend?

Accepted Answer

Deploy Amazon Aurora PostgreSQL with a cross-Region Aurora Replica, and configure the application to use the replica's endpoint for failover.. Aurora PostgreSQL with a cross-Region replica meets the RPO and RTO requirements while eliminating Oracle licensing costs and reducing operational overhead. Aurora manages replication and failover, and cross-Region replicas provide a viable disaster recovery strategy. The other options either fail to meet cross-Region failover, increase licensing costs, or require significant application changes that are not feasible for a legacy Oracle database.

Answer

Deploy Amazon EC2 instances running Oracle Database Enterprise Edition with Data Guard, and use an Auto Scaling group to manage failover across Regions.

Answer

Deploy Amazon DynamoDB global tables in two Regions, and migrate the Oracle schema to DynamoDB.

Answer

Deploy Amazon RDS for Oracle in a Multi-AZ configuration in the primary Region, and use Oracle Active Data Guard to replicate to a cross-Region read replica.

Question 5

A healthcare company is building a new analytics platform that ingests patient records from on-premises systems into Amazon S3, then transforms them with AWS Glue and queries them with Amazon Athena. Compliance requires that data be encrypted at rest with customer-managed keys, that access be auditable, and that analysts in the analytics account be prevented from reading raw records in the landing bucket while still reading transformed data. Which two design steps should the solutions architect take? (Choose two.)

Accepted Answer

Enable AWS CloudTrail data events for the landing and transformed S3 buckets and deliver them to a centralized log archive account.. Auditability comes from CloudTrail S3 data events delivered to a locked-down log archive account, which captures object-level reads and writes of patient records. Access separation comes from an explicit deny on the landing bucket for the analyst role combined with KMS customer-managed keys, so decryption of raw data can also be revoked through the key policy.

Answer

Configure an S3 Lifecycle rule to transition the landing bucket objects to S3 Glacier Instant Retrieval after one day.

Answer

Enable S3 default encryption with SSE-S3 on both buckets and rely on IAM identity-based policies alone to separate analyst access.

Answer

Create an S3 access point for the landing bucket and attach it to the analytics VPC so analysts can reach the raw data privately.

Question 6

A financial services company is designing a new multi-account AWS environment using AWS Organizations. The security team must ensure that all Amazon S3 buckets in every member account are encrypted with AWS KMS customer managed keys and that no bucket can be made public. They also need the ability to prevent individual account administrators from disabling these protections. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

Enable S3 Block Public Access at the organization level in AWS Organizations, and create an SCP that denies s3:PutBucketEncryption when the request does not include a customer managed AWS KMS key. Attach the SCP to the root.. Organization-level S3 Block Public Access provides a single, organization-wide preventive control that applies to all existing and future accounts, removing the need to configure each account individually. Pairing it with an SCP that denies s3:PutBucketEncryption unless a customer managed KMS key is specified ensures that all new buckets use the required encryption and that account administrators cannot override the control. This design centralizes governance and minimizes ongoing operational effort.

Answer

Use AWS Config rules in each member account to detect unencrypted S3 buckets and public buckets. Configure an AWS Lambda function to remediate noncompliant buckets by applying SSE-KMS and removing public access.

Answer

Create an SCP that denies s3:PutBucketPolicy when the policy grants public access, and denies s3:PutBucketAcl when the ACL grants public access. Attach the SCP to the root of the organization.

Answer

Enable S3 Block Public Access at the account level for every member account, and create an SCP that denies s3:PutBucketEncryption unless the request specifies aws:kms with a customer managed key.

Question 7

A company is building a new serverless application that uses AWS Lambda functions triggered by Amazon S3 events. The application processes large files uploaded to an S3 bucket. The processing time can vary from a few seconds to several minutes, and the company wants to ensure that failed processing attempts are retried automatically and that the order of processing is not critical. The company also wants to minimize the number of Lambda invocations for each file. Which design should a solutions architect recommend?

Accepted Answer

Configure S3 to send events to an Amazon SQS queue, and have a Lambda function poll the queue to process files. Use a visibility timeout that exceeds the Lambda function's timeout.. Decoupling S3 from Lambda with an SQS queue allows for automatic retries and accommodates processing times up to the Lambda timeout limit. The visibility timeout should be set higher than the Lambda timeout to prevent duplicate processing. This design ensures reliable processing with minimal invocations and meets the requirement for automatic retries.

Answer

Configure the S3 bucket to send events directly to a Lambda function, and enable the Lambda function's dead-letter queue (DLQ) to capture failed invocations.

Answer

Configure S3 to send events to an Amazon Kinesis data stream, and have a Lambda function process the stream with a batch size of 1.

Answer

Configure S3 to send events to an Amazon SNS topic, and subscribe a Lambda function to the topic. Enable SNS delivery retries.

Question 8

A company is designing a disaster recovery strategy for a critical application running on AWS. The application uses an Amazon RDS for PostgreSQL database in the us-east-1 Region. The company requires an RPO of 1 minute and an RTO of 5 minutes in the event of a regional failure. The application also needs to be able to fail back to the primary Region when it recovers. Which solution meets these requirements?

Accepted Answer

Configure an Amazon Aurora PostgreSQL global database with the primary in us-east-1 and a secondary in us-west-2. In the event of a failure, promote the secondary to primary. Use the managed planned failover feature to fail back when us-east-1 recovers.. Amazon Aurora PostgreSQL global databases replicate data across Regions with low latency, providing an RPO of about 1 second and an RTO of under 1 minute. The managed planned failover allows for a controlled switchover back to the primary Region with minimal data loss, meeting the RPO and RTO requirements and simplifying failback.

Answer

Configure an Amazon RDS for PostgreSQL read replica in us-west-2. In the event of a failure, promote the read replica to a standalone database and update the application to point to the new endpoint. Use AWS Database Migration Service (AWS DMS) to replicate changes back to us-east-1 when it recovers.

Answer

Configure an Amazon RDS for PostgreSQL Multi-AZ deployment with a standby in us-west-2. In the event of a failure, promote the standby to primary and update the application to point to the new endpoint.

Answer

Configure an Amazon RDS for PostgreSQL database with a cross-Region automated backup copy to us-west-2. In the event of a failure, restore the backup in us-west-2 and update the application to point to the new endpoint.

Question 9

A company is deploying a containerized application on Amazon ECS with the Fargate launch type. The application must store and retrieve sensitive configuration data, such as database credentials and API keys, securely. The security team requires that the secrets are encrypted at rest using AWS KMS customer managed keys and that access is audited. The application code should not contain any secrets. What should a solutions architect recommend?

Accepted Answer

Store the secrets in AWS Systems Manager Parameter Store as SecureString parameters encrypted with a KMS customer managed key, and grant the ECS task execution role permission to retrieve them. Reference the parameters in the container definition.. AWS Systems Manager Parameter Store SecureString parameters integrate natively with Amazon ECS. The task execution role can be granted permission to fetch the parameters, and the container definition can reference them as secrets. This keeps sensitive data out of the application code and provides encryption at rest using KMS customer managed keys. Access is logged in CloudTrail, meeting the audit requirement.

Answer

Store the secrets in an Amazon S3 bucket encrypted with SSE-KMS and have the application download them at startup.

Answer

Store the secrets in AWS Secrets Manager and retrieve them using the AWS SDK within the application code.

Answer

Store the secrets in environment variables in the ECS task definition, encrypted with KMS.

Question 10

A financial services company is designing a new multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across all accounts enforce encryption at rest with AWS KMS customer managed keys (CMKs) and that any attempt to disable encryption or use default encryption be denied. The company also wants to prevent the creation of S3 buckets without encryption. The solution must be centrally managed and apply to all existing and future accounts. What should be implemented?

Accepted Answer

Use AWS Organizations service control policies (SCPs) to deny s3:PutBucketEncryption and s3:CreateBucket unless the request includes the required KMS key and encryption settings.. Service control policies (SCPs) in AWS Organizations provide centralized, preventive guardrails that apply to all accounts. By denying s3:CreateBucket and s3:PutBucketEncryption unless the request specifies the required KMS key, you enforce encryption at rest for all S3 buckets. SCPs automatically apply to new accounts and cannot be overridden by account-level administrators, ensuring consistent compliance.

Answer

Create an IAM policy in each account that denies s3:PutBucketEncryption with a condition that the encryption algorithm is not aws:kms, and attach it to all IAM roles.

Answer

Enable S3 Block Public Access at the organization level and use S3 bucket policies to require encryption headers for all PUT requests.

Answer

Configure AWS Config rules in each account to detect unencrypted S3 buckets and automatically remediate them using AWS Systems Manager Automation documents.

Question 11

A company is designing a new serverless application that will process a high volume of events from multiple sources, including Amazon S3, Amazon DynamoDB Streams, and custom applications. The events must be processed in near real-time, and the results must be stored in an Amazon S3 bucket. The company wants to minimize operational overhead and ensure that events are not lost. Some events may require longer processing times, up to 15 minutes. What should a solutions architect recommend?

Accepted Answer

Use AWS Step Functions to orchestrate AWS Lambda functions, with Amazon S3 for storage.. AWS Step Functions is the best choice because it can orchestrate complex workflows, handle long-running processes (up to one year), and provide built-in retry and error handling. It integrates with multiple event sources and can invoke Lambda functions for processing. This ensures events are not lost and processing is reliable. Other options have limitations with long-running tasks or event durability.

Answer

Use Amazon EventBridge to route events to AWS Lambda functions, and store results in Amazon S3.

Answer

Use Amazon Kinesis Data Streams to ingest events, AWS Lambda to process them, and store results in Amazon S3.

Answer

Use Amazon Simple Queue Service (Amazon SQS) to queue events, AWS Lambda to process them, and store results in Amazon S3.

Question 12

A logistics company is designing a new order-tracking system that must remain available for reads and writes if an entire AWS Region becomes unavailable. The order service writes to an Amazon DynamoDB table, and the company wants the recovery point objective to be near zero with no application changes to handle failover logic. Which approach should the solutions architect recommend?

Accepted Answer

Use DynamoDB global tables with a multi-Region AWS Global Accelerator endpoint in front of the Regional table endpoints in both Regions.. DynamoDB global tables keep two Regional replicas synchronized, giving a near-zero recovery point objective, while Global Accelerator provides a static anycast entry point whose health checks steer clients to the healthy Region. Together they deliver read and write availability during a Regional failure without application-level failover code.

Answer

Create a DynamoDB global table with replicas in two Regions and configure the application to use the Regional endpoint of the active Region.

Answer

Enable point-in-time recovery on the DynamoDB table and restore it into a second Region using AWS Backup cross-Region copy.

Answer

Use DynamoDB global tables with multi-Region strong consistency and point the application at a global endpoint that routes to the nearest healthy Region.

Question 13

A healthcare company is designing a new patient portal on AWS. The portal runs on Amazon ECS with the Fargate launch type and must store protected health information (PHI) in a PostgreSQL-compatible database. Compliance regulations require that the data be encrypted at rest with keys that the company creates and manages, and that the encryption keys be rotated annually without any downtime. The database must be highly available across two Availability Zones. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Deploy Amazon Aurora PostgreSQL with a Multi-AZ configuration. Enable encryption at rest using an AWS Key Management Service (AWS KMS) customer managed key, and configure automatic annual key rotation on that key.. Aurora PostgreSQL delivers Multi-AZ high availability natively and supports encryption with customer managed AWS KMS keys. Automatic key rotation can be enabled on a customer managed key with a configurable period, so the annual rotation requirement is met without custom code or downtime. The other approaches either use keys the company does not manage, rely on unsupported rotation mechanisms, or introduce operational complexity.

Answer

Deploy Amazon Aurora PostgreSQL with a Multi-AZ configuration. Encrypt the cluster with an AWS KMS customer managed key, and build an AWS Lambda function that creates a new KMS key each year and re-encrypts the database.

Answer

Deploy Amazon RDS for PostgreSQL with a Multi-AZ standby. Enable encryption at rest using a customer managed key in AWS KMS, and configure the key policy to rotate the key material every 365 days.

Answer

Deploy Amazon RDS for PostgreSQL with a Multi-AZ standby. Encrypt the database using the default AWS managed key aws/rds, and create a new key every year to replace it.

Question 14

A company is building a new serverless application that processes events from an Amazon Kinesis Data Stream. The application uses AWS Lambda functions to process the events. The company expects the event volume to vary significantly, with occasional spikes. The Lambda functions must process events in order and handle failures without blocking the entire shard. Which solution should a solutions architect recommend?

Accepted Answer

Configure the Lambda function with an event source mapping to the Kinesis stream, and set the maximum retry attempts to 3. Use a dead-letter queue (DLQ) for failed records.. Lambda event source mapping for Kinesis automatically polls the stream, processes records in order, and manages shard iterators. By configuring maximum retry attempts and a dead-letter queue, failed records are set aside after retries, preventing shard blockage. This approach provides built-in scalability, error handling, and ordered processing, which aligns with the requirements.

Answer

Configure the Lambda function with a reserved concurrency of 1 to ensure ordered processing and avoid failures.

Answer

Use an Amazon SQS queue as an intermediary between Kinesis Data Stream and Lambda. Configure the Lambda function to poll the SQS queue.

Answer

Configure the Lambda function to be invoked directly by the Kinesis Data Stream using an AWS SDK call from a producer application.

Question 15

A healthcare company is designing a new solution to ingest streaming patient monitoring data from thousands of bedside devices. The data must be processed in near real time, stored durably for at least seven years, and queried by analytics teams using standard SQL. The company also needs to replay the last 24 hours of data if a processing error occurs. Which combination of AWS services should a solutions architect recommend?

Accepted Answer

Amazon Kinesis Data Streams for ingestion, AWS Lambda for processing, Amazon Timestream for storage and SQL queries, and Amazon S3 for long-term archival.. Kinesis Data Streams provides the required replay capability because it retains records for up to 365 days, allowing the last 24 hours to be reprocessed. Lambda enables near real-time processing without server management. Amazon Timestream is designed for time-series data and supports SQL queries, while its storage tiering can retain data for years. Archiving to Amazon S3 ensures durable long-term retention for seven years. Together, these services satisfy ingestion, processing, querying, replay, and retention requirements.

Answer

Amazon Kinesis Data Streams for ingestion, AWS Lambda for processing, Amazon S3 for durable storage, and Amazon Athena for SQL queries.

Answer

Amazon Kinesis Data Firehose for ingestion, AWS Lambda for transformation, Amazon S3 for storage, and Amazon Redshift Spectrum for SQL queries.

Answer

Amazon Managed Streaming for Apache Kafka (Amazon MSK) for ingestion, AWS Lambda for processing, Amazon S3 for durable storage, and Amazon Athena for SQL queries.