SAP-C02 Design for New Solutions Practice Test 21 — 15 Questions

Question 1

A media company is building a video transcoding pipeline on AWS. Jobs are submitted to an Amazon SQS standard queue, and a fleet of EC2 worker instances polls the queue. The company must guarantee that each video is transcoded exactly once, even if a worker instance crashes mid-job, and jobs must be processed in the exact order they were submitted. Which combination of changes should a solutions architect make to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replace the standard queue with an SQS FIFO queue and use a message group ID per video, and set the visibility timeout to be longer than the maximum expected transcoding duration.. Strict ordering plus exactly-once processing for a queue-based worker fleet maps to an SQS FIFO queue with message group IDs to serialize per-video work. Setting the visibility timeout longer than the maximum processing time stops other consumers from picking up a message that is still in flight. Together these deliver ordered, single-delivery processing that survives worker crashes, which a standard queue cannot provide.

Answer

Keep the standard queue and have each worker delete the message immediately upon receipt before starting the transcode.

Answer

Replace the standard queue with an Amazon Kinesis Data Streams stream and have workers use the Kinesis Client Library with one shard per video.

Answer

Keep the standard queue but enable content-based deduplication and increase the message retention period to 14 days.

Question 2

A financial services company is deploying a new multi-tier application on AWS. The application runs on Amazon EC2 instances in private subnets across three Availability Zones. A security policy requires that all data stored on Amazon EBS volumes attached to these instances be encrypted at rest with a customer-managed AWS KMS key, and that the encryption cannot be changed or disabled by any EC2 administrator. The company also needs to audit all key usage. Which solution meets these requirements?

Accepted Answer

Create a customer-managed KMS key with a key policy that allows the EC2 service to use it, and enable EBS encryption by default in the region using that key. Launch instances with encrypted volumes.. The correct solution uses EBS encryption by default with a customer-managed KMS key. This setting ensures all new EBS volumes in the region are automatically encrypted with the specified key. The key policy can restrict usage, and CloudTrail provides audit logs of key usage. This meets the requirements for encryption at rest, customer control, and auditability.

Answer

Encrypt the EBS volumes using a customer-managed KMS key during instance launch, and use AWS Identity and Access Management (IAM) policies to deny the ec2:DisableEbsEncryptionByDefault action to all administrators.

Answer

Use AWS Certificate Manager (ACM) to provision a certificate and attach it to the EBS volumes to encrypt data at rest.

Answer

Enable EBS encryption by default using the AWS managed key aws/ebs, and apply a bucket policy to the EBS volumes to prevent administrators from disabling encryption.

Question 3

A healthcare company is designing a new claims-processing platform on AWS. Regulatory requirements mandate that all data be encrypted at rest using customer-managed keys, and that the company retain the ability to audit every use of those keys independently of AWS. The security team also requires that key material never leave a FIPS 140-2 Level 3 validated hardware security module (HSM) that the company controls. The company has an on-premises HSM cluster and wants the cloud workload to work with the same key hierarchy. Which combination of AWS services should the solutions architect recommend to meet these requirements? (Choose two.)

Accepted Answer

AWS CloudHSM cluster with the customer's own key material imported, integrated with the application via the PKCS#11 library. The two requirements that drive the design are customer-controlled FIPS 140-2 Level 3 hardware and independent auditing of key usage. A CloudHSM cluster supplies the dedicated, single-tenant HSM hardware, and a KMS custom key store bridges that cluster to AWS services so the same customer-managed keys can encrypt S3, EBS, and database volumes without custom crypto code in the application. Together they meet the regulatory mandate while keeping native service integration.

Answer

AWS Secrets Manager with a customer-managed KMS key used to encrypt all claim records

Answer

AWS Certificate Manager (ACM) with a private certificate authority for encrypting data at rest in Amazon S3

Answer

AWS Key Management Service (AWS KMS) with a customer-managed CMK and automatic annual key rotation enabled

Question 4

A financial services company is designing a new multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across all accounts enforce encryption at rest with AWS KMS customer managed keys, and that no account administrator can disable this control. The company also needs the ability to centrally audit compliance. Which solution should a solutions architect recommend?

Accepted Answer

Create an SCP that denies s3:PutObject unless the request includes server-side encryption with a KMS key, and use AWS Config to monitor compliance.. The requirement is to prevent unencrypted S3 uploads across all accounts, even by account administrators, and to audit compliance centrally. An SCP can deny s3:PutObject calls that do not include the required encryption headers, providing preventive control at the organization level. AWS Config rules then continuously audit and report compliance, enabling centralized visibility.

Answer

Create an S3 bucket policy in each account that denies unencrypted PUT requests, and attach it to every bucket manually.

Answer

Enable AWS CloudTrail in all accounts and use Amazon Detective to monitor for unencrypted S3 uploads, then remediate with AWS Lambda.

Answer

Use AWS Organizations to apply a service control policy (SCP) that denies s3:PutObject without encryption headers, and enable AWS Config rules for auditing.

Question 5

A media company is building a new transcoding pipeline on AWS. Source video files are uploaded to an Amazon S3 bucket, and each upload must trigger a short-lived AWS Lambda function that starts an AWS Elemental MediaConvert job. The company expects unpredictable bursts of up to 5,000 uploads per minute, and no events may be lost during scaling. The solutions architect must choose the most operationally efficient, fully managed event source that can invoke the Lambda function at this scale. Which solution meets these requirements?

Accepted Answer

Configure the S3 bucket to publish s3:ObjectCreated:* events directly to the Lambda function as an event source.. S3 event notifications can invoke Lambda directly, providing a fully managed, asynchronous, at-least-once delivery path that scales with upload volume. It requires no queue, no polling, and no scheduled reconciliation, so it is the most operationally efficient way to start a MediaConvert job per uploaded object while avoiding lost events during bursts.

Answer

Schedule an AWS Lambda function every minute to list the S3 bucket and process new objects using the object creation timestamp.

Answer

Enable S3 EventBridge notifications and create an Amazon EventBridge rule that targets the Lambda function.

Answer

Create an Amazon SQS FIFO queue and have the Lambda function poll the queue; configure S3 to send notifications to the queue.

Question 6

A company is designing a new hybrid architecture that connects its on-premises data center to AWS. The company needs to transfer large datasets nightly to Amazon S3 and requires a highly available, low-latency connection for interactive applications. The company also wants to minimize egress costs for data transferred from AWS to on-premises. Which two actions should a solutions architect recommend? (Choose two.)

Accepted Answer

Use a Direct Connect public virtual interface to access Amazon S3, and take advantage of Direct Connect data transfer out rates which are lower than internet egress rates.. The two actions that meet the requirements are establishing redundant Direct Connect connections across diverse locations and using a public virtual interface for S3 access to benefit from lower data transfer out rates. Redundant connections ensure high availability and low latency for interactive applications, while the public virtual interface provides a cost-effective path for S3 data transfers and reduces egress costs compared to internet-based transfer.

Answer

Enable S3 Transfer Acceleration on the bucket used for nightly transfers to speed up uploads from on-premises.

Answer

Use AWS Site-to-Site VPN as the primary connection for all traffic, and use AWS Direct Connect as a backup.

Answer

Configure an AWS Direct Connect gateway to connect multiple VPCs in different AWS Regions to the on-premises network.

Question 7

A healthcare company is designing a new claims-processing platform on AWS. The platform must ingest HL7 messages that arrive continuously from on-premises systems, retain each message for exactly 7 years for audit purposes, and allow a downstream analytics team to replay any 24-hour window of messages up to 5 times per day. The compliance team requires that no message be lost even if the consumer application is unavailable for several hours. Which combination of AWS services should the solutions architect use to meet these requirements with the LEAST operational overhead?

Accepted Answer

Amazon Kinesis Data Streams in on-demand mode with 365-day retention, and Amazon Data Firehose delivering the same stream to Amazon S3 with a lifecycle policy transitioning objects to Amazon S3 Glacier Instant Retrieval. The design separates the replayable buffer from the durable archive. A Kinesis data stream with extended retention holds messages long enough for repeated windowed replays and prevents loss when consumers are down, while Firehose continuously delivers the same data into Amazon S3. A lifecycle policy then transitions objects into an archival storage class to satisfy the seven-year audit obligation without custom code or servers.

Answer

Amazon Data Firehose delivering to Amazon S3 with a 7-year lifecycle policy, plus an Amazon SQS FIFO queue as the replay buffer

Answer

Amazon Managed Streaming for Apache Kafka (Amazon MSK) with a 7-day topic retention, and AWS Glue jobs that read the topics on demand

Answer

Amazon Kinesis Data Streams with a 7-day retention period, and an AWS Lambda function that writes each record to Amazon S3 Glacier Deep Archive

Question 8

A healthcare company is designing a new claims-processing platform on AWS that ingests Protected Health Information (PHI). The compliance team requires that data be encrypted in transit and at rest, that access be limited to specific IAM principals, and that all API activity be auditable for at least seven years. The platform uses Amazon API Gateway, AWS Lambda, Amazon DynamoDB, and Amazon S3. Which two design choices meet these requirements? (Choose two.)

Accepted Answer

Enforce TLS 1.2 or higher on all API Gateway endpoints and S3 bucket policies using aws:SecureTransport, and enable CloudTrail with a multi-Region trail delivering to an S3 bucket with S3 Object Lock in compliance mode.. The requirements map to three controls: encryption in transit, encryption at rest with customer-controlled keys, and tamper-resistant audit retention. Enforcing TLS 1.2+ and aws:SecureTransport covers transit, a multi-Region CloudTrail trail with S3 Object Lock in compliance mode covers seven-year auditability, and KMS customer managed keys with narrowly granted kms:Decrypt cover at-rest encryption and least-privilege access to specific IAM principals. Together these satisfy every stated compliance constraint.

Answer

Use AWS CloudTrail Lake with a seven-year event data store and configure API Gateway to use AWS Certificate Manager (ACM) public certificates for TLS termination.

Answer

Store PHI in Amazon S3 with SSE-S3 default encryption and use S3 server access logs delivered to a bucket with a 90-day lifecycle expiration to control storage costs.

Answer

Configure DynamoDB tables with AWS owned keys and enable DynamoDB Streams to replicate changes to a second table in another Region for durability.

Question 9

A company is designing a new application that will use Amazon API Gateway to expose a REST API. The backend is an AWS Lambda function that queries an Amazon Aurora MySQL database. The company expects the API to receive a high volume of requests, and the database must handle read-heavy traffic. The company wants to minimize latency and cost. Which solution should a solutions architect recommend?

Accepted Answer

Configure API Gateway with an Edge-optimized endpoint and enable caching. Use Aurora Auto Scaling to add read replicas and configure the Lambda function to use the reader endpoint.. An Edge-optimized API Gateway endpoint leverages CloudFront to reduce latency for geographically distributed clients. API Gateway caching reduces the number of backend invocations, lowering cost. Aurora Auto Scaling dynamically adjusts the number of read replicas based on demand, and the reader endpoint distributes read queries across replicas. This solution provides low latency, scalability, and cost efficiency for read-heavy workloads.

Answer

Configure API Gateway with an Edge-optimized endpoint and use AWS Global Accelerator to route traffic to the Lambda function. Use an Aurora Replica for read queries.

Answer

Configure API Gateway with a Regional endpoint and enable caching. Use an Aurora Replica for read queries and route read requests to the replica endpoint.

Answer

Configure API Gateway with a Private endpoint and use an Application Load Balancer to distribute traffic to multiple Lambda functions. Use an Aurora Replica for read queries.

Question 10

A global retail company is designing a new order-processing system on AWS. The system must provide read and write access to order data with single-digit millisecond latency for users in North America, Europe, and Asia. The company wants to avoid managing database servers and must ensure that data is replicated across Regions automatically. The solution must also support automatic failover to another Region if an entire Region becomes unavailable. (Choose two.)

Accepted Answer

Use Amazon DynamoDB global tables to replicate the order data across the required Regions, and configure the application to use the regional endpoint in each Region.. DynamoDB global tables deliver active-active multi-Region replication with single-digit millisecond latency and no server management, meeting the latency and replication requirements. Pairing this with Route 53 latency-based routing directs users to the closest healthy Region, improving performance and enabling failover. Together they provide a serverless, multi-Region order-processing system with automatic replication and low-latency access.

Answer

Use Amazon S3 Cross-Region Replication to replicate order data across Regions, and have the application read and write directly to S3 using the AWS SDK.

Answer

Deploy Amazon Aurora Global Database with a primary cluster in one Region and secondary clusters in the other Regions, and configure the application to read from the secondary clusters.

Answer

Deploy Amazon RDS for MySQL with Multi-AZ in each Region, and use AWS Database Migration Service (AWS DMS) to replicate data between Regions continuously.

Question 11

A financial services firm runs a latency-sensitive trading analytics platform on Amazon EC2 instances spread across three Availability Zones. The platform reads a shared reference dataset of several hundred gigabytes that is updated once per day by a batch job. Analysts in the same Region must see the new dataset within minutes of the batch completing, and each instance must read the files at local-disk speed. The company wants to minimize storage cost while meeting the read performance requirement. Which storage design should the solutions architect recommend?

Accepted Answer

Create an Amazon FSx for Lustre file system linked to an S3 bucket, and mount it on the instances in all three Availability Zones. The workload needs high-throughput, low-latency reads of a large shared dataset that is refreshed daily, with cost efficiency. FSx for Lustre is purpose-built for high-performance analytics, and linking it to the S3 bucket that holds the batch output means the refresh propagates through lazy loading rather than a full copy. Provisioning only the capacity needed for the working set keeps cost aligned with the once-per-day update pattern.

Answer

Store the dataset in Amazon S3 and have each instance read objects directly over the internet gateway on every request

Answer

Create an Amazon EFS file system in General Purpose performance mode and mount it on all instances across the three Availability Zones

Answer

Attach an Amazon EBS gp3 volume to each instance and copy the dataset to every volume after each daily batch job

Question 12

A healthcare company is designing a new patient portal that must authenticate users against its existing on-premises Active Directory. The company wants to minimize operational overhead and avoid managing directory synchronization servers. The portal runs on Amazon EC2 instances in a private subnet and must integrate with the corporate identity provider. Which solution should a solutions architect recommend?

Accepted Answer

Deploy AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) and establish a trust relationship with the on-premises Active Directory.. The requirement to authenticate against an existing on-premises Active Directory with minimal operational overhead points to AWS Managed Microsoft AD, which supports a trust relationship with the on-premises domain. This allows the portal to use corporate credentials without deploying or managing synchronization servers, and it supports domain join for the EC2 instances.

Answer

Deploy an AD Connector to the existing on-premises Active Directory and join the EC2 instances to the connector directory.

Answer

Create an Amazon Cognito user pool and configure SAML federation with the on-premises Active Directory Federation Services (AD FS).

Answer

Deploy a Simple AD directory and configure a one-way trust to the on-premises Active Directory.

Question 13

A healthcare company is migrating a legacy on-premises application to AWS. The application uses a relational database and requires sub-millisecond latency for read operations. The database must be highly available across two Availability Zones and support automatic failover. The company wants to minimize operational overhead. Which solution meets these requirements?

Accepted Answer

Deploy Amazon Aurora MySQL with a Multi-AZ cluster and use Aurora Replicas for read scaling.. Aurora MySQL provides a relational database with a distributed storage layer that replicates across three Availability Zones. Aurora Replicas share the same storage volume and can serve reads with very low latency, often sub-millisecond. The cluster supports automatic failover to an Aurora Replica, and AWS manages the underlying infrastructure, minimizing operational overhead.

Answer

Deploy Amazon DynamoDB with global tables and use DAX for read caching.

Answer

Deploy Amazon EC2 instances running MySQL with synchronous replication across two Availability Zones.

Answer

Deploy Amazon RDS for MySQL with a Multi-AZ deployment and use read replicas for read scaling.

Question 14

A company is migrating a legacy on-premises application to AWS. The application uses a shared file system that must be accessible by hundreds of EC2 instances across multiple Availability Zones with high throughput and low latency. The company requires a POSIX-compliant file system that supports concurrent access and automatic scaling. Which AWS service should be used?

Accepted Answer

Amazon Elastic File System (Amazon EFS) with Max I/O performance mode and Elastic throughput mode.. Amazon EFS with Max I/O performance mode and Elastic throughput mode is designed for scenarios with many concurrent clients and high throughput demands. Max I/O mode scales to support thousands of instances, and Elastic throughput automatically adjusts to workload, providing consistent performance. This meets the POSIX compliance and scalability requirements.

Answer

Amazon FSx for Lustre with a scratch file system deployment type.

Answer

Amazon FSx for Windows File Server with Multi-AZ deployment.

Answer

Amazon Elastic File System (Amazon EFS) with General Purpose performance mode and Bursting throughput mode.

Question 15

A retail company is migrating a legacy order-processing system to AWS. The system must survive the loss of an entire Availability Zone without manual intervention and must keep running if a single AWS service dependency degrades. The company wants to minimize operational overhead and avoid managing servers. Which two design choices meet these requirements? (Choose two.)

Accepted Answer

Deploy the application as an AWS Lambda function fronted by an Amazon API Gateway Regional endpoint with a custom domain, and configure the function to use a Multi-AZ Amazon RDS database.. Resilience to an Availability Zone failure with minimal server management comes from spreading serverless or containerized compute across AZs and using services that replicate internally. Lambda behind a Regional API Gateway endpoint with Multi-AZ RDS handles stateless requests, while SQS decoupling with multi-AZ Fargate consumers isolates order intake from downstream degradation.

Answer

Host the application on Amazon EC2 instances in an Auto Scaling group pinned to a single Availability Zone, with an Application Load Balancer.

Answer

Run the application on a single large EC2 instance in one Availability Zone with an Elastic IP address and take nightly EBS snapshots.

Answer

Store all order state on a single EC2 instance's instance store volume and replicate the volume to another instance with a nightly cron job.