SAP-C02 Design for New Solutions Practice Test 20 — 15 Questions

Question 1

A company is building a new data analytics platform on AWS. The platform ingests streaming data from multiple sources, processes it in real time, and stores the results in Amazon S3 for later analysis. The data volume is expected to be up to 50 GB per day. The company needs to choose a service for real-time stream processing. Which AWS service is most appropriate for this use case?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics is the most appropriate service for real-time stream processing because it allows you to process streaming data in real time using SQL or Apache Flink. Option A (Amazon Kinesis Data Firehose) is designed for loading streaming data into data stores like S3, not for real-time processing. Option B (Amazon Kinesis Data Streams) is a data ingestion service that captures and stores data streams, but does not provide built-in processing capabilities. Option D (Amazon EMR) is primarily used for batch processing of large data sets using frameworks like Hadoop and Spark, and is not optimized for real-time stream processing.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Kinesis Data Streams

Answer

Amazon EMR

Question 2

A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for storing and rotating secrets centrally. Option A: AWS KMS is for encryption keys, not secret storage. Option B: AWS CloudHSM provides hardware security modules for key storage, not secret management with rotation. Option C: AWS Systems Manager Parameter Store can store secrets but does not natively rotate them; rotation requires custom solutions.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 3

A company is migrating a legacy on-premises application to AWS. The application uses a monolithic architecture and a MySQL database. The company wants to refactor the application into microservices and use a NoSQL database for better scalability. The new application will be deployed on Amazon EKS. The database must be highly available and support automatic scaling. Which database service should the company use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a NoSQL database that supports high availability and automatic scaling. Option A: Amazon Aurora Serverless is a relational database, not NoSQL. Option C: Amazon DocumentDB (with MongoDB compatibility) is a NoSQL database but is MongoDB-compatible; DynamoDB is more fully managed and serverless and better suited for microservices on EKS. Option D: Amazon RDS for MySQL with Multi-AZ deployment is relational and not NoSQL.

Answer

Amazon Aurora Serverless

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon RDS for MySQL with Multi-AZ deployment

Question 4

A company is building a new application that will run on AWS Lambda. The application needs to store and retrieve user preferences in a key-value format. The data is accessed frequently and must be highly available. The company expects low latency for reads and writes. Which AWS service should be used as the data store?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. It is designed for low-latency, high-availability access, making it ideal for storing and retrieving user preferences in a key-value format. Option A: Amazon S3 is object storage, not a key-value store, and is not optimized for low-latency reads and writes for small objects. Option B: Amazon ElastiCache for Memcached is an in-memory key-value store, but it is not persistent and typically used for caching, not as a primary data store for persistent user preferences. Option C: Amazon RDS for PostgreSQL is a relational database, which requires schema definition and is not optimized for simple key-value access patterns.

Answer

Amazon S3

Answer

Amazon ElastiCache for Memcached

Answer

Amazon RDS for PostgreSQL

Question 5

A company is deploying a new web application that uses Amazon S3 to store static content and Amazon CloudFront for content delivery. The application also uses an API Gateway with Lambda for backend logic. The company wants to protect the API from common web exploits like SQL injection and cross-site scripting. Which AWS service should be added to the architecture?

Accepted Answer

AWS WAF. AWS WAF integrates with API Gateway and CloudFront to protect against web exploits like SQL injection and cross-site scripting. Option A: Amazon GuardDuty is for threat detection, not inline protection. Option B: Amazon Inspector is for vulnerability assessment. Option C: AWS Shield Advanced provides DDoS protection, not application-layer filtering.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Shield Advanced

Question 6

A company is designing a new data lake on AWS. The data lake will store structured and unstructured data from various sources. The company needs a solution that can automatically catalog the data and make it searchable. Data will be stored in Amazon S3. Which AWS service should be used to catalog and enable search across the data lake?

Accepted Answer

AWS Glue Data Catalog. AWS Glue Data Catalog automatically discovers and catalogs metadata from data stored in Amazon S3, making it searchable. Option A, Amazon Athena, is a serverless query service that uses the Glue Data Catalog but does not itself catalog data. Option B, Amazon EMR, is a big data processing service using frameworks like Spark and Hadoop, not a catalog. Option C, Amazon Redshift Spectrum, allows querying data in S3 from Redshift but does not provide a catalog.

Answer

Amazon Athena

Answer

Amazon EMR

Answer

Amazon Redshift Spectrum

Question 7

A company is designing a new application that will run on Amazon EC2 instances. The application needs to access an Amazon S3 bucket to read and write objects. The company wants to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. Which TWO steps should the company take?

Accepted Answer

Attach the IAM role to the EC2 instance profile.. An IAM role can be attached to an EC2 instance via an instance profile, allowing the instance to obtain temporary credentials from the AWS Security Token Service (STS) without storing any long-term credentials on the instance. This is the recommended secure method for granting EC2 instances access to AWS services like S3.

Answer

Store the AWS access key and secret access key in a configuration file on the instance.

Answer

Create an S3 bucket policy that allows access from the EC2 instance's IP address.

Answer

Configure the EC2 security group to allow outbound traffic to S3.

Question 8

A company is designing a new application that will run on Amazon ECS with Fargate. The application must process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. The workload is unpredictable and can scale from 0 to thousands of messages per second. What is the MOST cost-effective and scalable architecture?

Accepted Answer

Use an AWS Lambda function with an SQS trigger to process messages and write to DynamoDB.. Using an AWS Lambda function with an SQS trigger is serverless, scales automatically with the queue depth, and incurs no cost when no messages are processed, making it the most cost-effective and scalable choice for unpredictable workloads. Option A is wrong because auto scaling based on CPU utilization does not directly correlate with the number of messages in the queue, potentially causing delays or over-provisioning. Option B is wrong because, although a target tracking policy based on SQS queue depth is better, an ECS with Fargate service still requires at least one running task, which may be idle and incur costs. Option C is wrong because Amazon Kinesis Data Streams is designed for real-time streaming, not standard message queuing, and is more expensive and complex than the SQS and Lambda combination.

Answer

Run an Amazon ECS service with Fargate that polls the SQS queue and writes to DynamoDB. Configure auto scaling based on CPU utilization.

Answer

Use an Amazon ECS service with Fargate and a target tracking scaling policy based on SQS queue depth.

Answer

Use Amazon Kinesis Data Streams to ingest messages and an AWS Lambda function to process and write to DynamoDB.

Question 9

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in two AWS Regions. The company needs to ensure that if one region becomes unavailable, traffic is automatically routed to the healthy region with minimal disruption. Which configuration meets these requirements?

Accepted Answer

Configure Route 53 latency-based routing with health checks attached to each ALB endpoint.. Route 53 latency-based routing with health checks ensures that traffic is directed to the region with the lowest latency, and if an ALB endpoint fails its health check, Route 53 automatically removes it from DNS responses, routing traffic to the healthy region. This provides the required active-active multi-region failover with minimal disruption.

Answer

Use Route 53 failover routing instead of latency-based routing.

Answer

Configure Route 53 latency-based routing without health checks.

Answer

Use Route 53 weighted routing with weights set to 50 for each region.

Question 10

A company is designing a new solution to store and analyze large amounts of log data from multiple sources. The logs must be retained for 90 days for recent analysis, and then archived to a more cost-effective storage class for an additional 5 years. The solution must support SQL-based queries. Which combination of AWS services should the company use?

Accepted Answer

Amazon S3 with lifecycle policies to transition objects to S3 Glacier Deep Archive after 90 days, and Amazon Athena for SQL queries.. Amazon S3 with lifecycle policies can automatically transition log objects from S3 Standard to S3 Glacier Deep Archive after 90 days, meeting the 90-day retention for recent analysis and the 5-year archival requirement at the lowest cost. Amazon Athena allows SQL-based queries directly on the log data stored in S3, without needing to load data into a separate database, making it a serverless and cost-effective solution for ad-hoc analysis.

Answer

Amazon Redshift with data sharing to retain logs for 5 years.

Answer

Amazon OpenSearch Service with UltraWarm storage to archive logs after 90 days.

Answer

Amazon RDS for PostgreSQL with automated backups to retain logs for 5 years.

Question 11

A company is designing a new data lake on Amazon S3. The data is ingested from various sources and must be encrypted at rest. The company has a strict requirement to use an AWS KMS customer master key (CMK) that is stored in a different AWS account for additional security. The S3 bucket is in Account A, and the KMS key is in Account B. Which steps are necessary to enable server-side encryption with AWS KMS (SSE-KMS) for objects in the S3 bucket?

Accepted Answer

Update the KMS key policy in Account B to grant Account A access to the key, and update the S3 bucket policy in Account A to allow the kms:Encrypt and kms:Decrypt actions for the key.. When using an AWS KMS CMK from a different account (Account B) for SSE-KMS on an S3 bucket in Account A, you must explicitly grant Account A access to the key via the KMS key policy in Account B. Additionally, the S3 bucket policy in Account A must allow the kms:Encrypt and kms:Decrypt actions for the cross-account key, as S3 will use these permissions to encrypt and decrypt objects on behalf of the bucket owner. Without both policy updates, the cross-account KMS operation will fail with an access denied error.

Answer

Enable SSE-KMS on the S3 bucket in Account A and specify the ARN of the KMS key from Account B. S3 will automatically use the key.

Answer

Update the KMS key policy in Account B to grant Account A access to the key. No changes needed in Account A.

Answer

Update the S3 bucket policy in Account A to allow s3:PutObject with the kms:Encrypt permission. No changes needed in Account B.

Question 12

A company is designing a highly available web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to EC2 instances in an Auto Scaling group across multiple Availability Zones. The application state is stored in an Amazon ElastiCache for Redis cluster. The company wants to minimize downtime during patching of the Redis cluster. What should the company do?

Accepted Answer

Deploy the Redis cluster with Multi-AZ and automatic failover enabled across two Availability Zones.. Deploying ElastiCache for Redis with Multi-AZ and automatic failover enabled ensures that if the primary node fails or requires patching, a read replica in a different Availability Zone is automatically promoted to primary, minimizing downtime. This aligns with the requirement for high availability during patching, as ElastiCache handles failover transparently without manual intervention.

Answer

Increase the Redis node type to handle the load and rely on the ElastiCache maintenance window.

Answer

Use a blue/green deployment strategy by creating a new Redis cluster and switching the application endpoint.

Answer

Deploy the Redis cluster as a single node in one Availability Zone and take regular snapshots.

Question 13

A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?

Accepted Answer

AWS Cloud Map with namespaces and service instances.. AWS Cloud Map is the correct choice because it is a cloud resource discovery service specifically designed for microservices architectures. It allows you to define custom namespaces (public, private DNS, or API-based) and register service instances with health checks. Services running on ECS with Fargate can then discover each other via DNS queries or API calls, enabling dynamic and secure communication without managing static IPs or load balancers.

Answer

AWS PrivateLink with VPC endpoint services.

Answer

Amazon Route 53 private hosted zones with DNS records for each service.

Answer

Elastic Load Balancing with internal load balancers for each service.

Question 14

A company is designing a new application that will use Amazon DynamoDB as its primary database. The application has two access patterns: one requires strongly consistent reads, and the other requires eventually consistent reads. The company wants to minimize costs while meeting the read consistency requirements. How should the company configure DynamoDB reads?

Accepted Answer

Use strongly consistent reads for the pattern that requires it, and eventually consistent reads for the other pattern.. DynamoDB supports both strongly consistent reads and eventually consistent reads at the API level (via the `ConsistentRead` parameter). Strongly consistent reads return the most up-to-date data but consume twice the read capacity units (RCUs) compared to eventually consistent reads. By using strongly consistent reads only for the access pattern that requires it, and eventually consistent reads for the other pattern, the company minimizes RCU consumption and thus costs while meeting the specific consistency requirements of each pattern.

Answer

Use strongly consistent reads for all read requests to ensure data accuracy.

Answer

Use DynamoDB Accelerator (DAX) to cache reads and achieve strong consistency.

Answer

Use DynamoDB global tables with strongly consistent reads enabled.

Question 15

A company is designing a new solution to host a static website on AWS. The website content is stored in an Amazon S3 bucket. The company wants to use a custom domain name (e.g., www.example.com) and enforce HTTPS. Which combination of AWS services should the company use?

Accepted Answer

Use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket.. Amazon CloudFront can terminate HTTPS at the edge using an SSL certificate from AWS Certificate Manager (ACM), and it can be configured with an origin pointing to an S3 bucket configured for static website hosting. This combination allows the use of a custom domain name (e.g., www.example.com) via a CloudFront alternate domain name (CNAME) and enforces HTTPS for all client connections, which S3 static website hosting alone cannot natively support.

Answer

Configure the S3 bucket for static website hosting and attach a custom SSL certificate using AWS Certificate Manager.

Answer

Use Amazon Route 53 with an alias record pointing to the S3 bucket and enable DNSSEC.

Answer

Use an Application Load Balancer in front of the S3 bucket and attach an SSL certificate from AWS Certificate Manager.