SAP-C02 Design for New Solutions Practice Test 21 — 15 Questions

Question 1

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application data is stored on Amazon EBS volumes. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. Which TWO actions should the company take to meet these objectives? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Amazon EBS snapshots to be taken every 15 minutes.. Taking Amazon EBS snapshots every 15 minutes ensures that the RPO of 15 minutes is met, as the maximum data loss is limited to the interval between snapshots. Option E is correct because copying EBS snapshots to another AWS Region and automating their restoration into EBS volumes enables cross-region recovery, which is necessary since the application runs in a single Region and the RTO of 2 hours allows time for the restore process.

Answer

Use Amazon EBS Multi-Attach to attach volumes to instances in another region.

Answer

Use AWS Backup to create a backup plan with a daily backup.

Answer

Use AWS CloudFormation to recreate the EC2 instances from a template.

Question 2

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS for PostgreSQL database. The database credentials must be rotated automatically every 30 days. Which THREE steps should the company take to securely manage the credentials? (Choose three.)

Accepted Answer

Store the database credentials in AWS Secrets Manager.. AWS Secrets Manager is designed to securely store, manage, and automatically rotate database credentials, including for Amazon RDS for PostgreSQL. By storing credentials in Secrets Manager, the company avoids hardcoding secrets in code or configuration files, ensuring a centralized and auditable secrets management solution.

Answer

Grant the Lambda function's IAM role permission to access the RDS database directly.

Answer

Write custom rotation logic in the Lambda function to change the database password.

Question 3

A company is designing a new web application that will be deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which THREE actions should the company take to meet these requirements? (Choose three.)

Accepted Answer

Launch EC2 instances in an Auto Scaling group across multiple Availability Zones.. Launching EC2 instances in an Auto Scaling group across multiple Availability Zones ensures that the application can withstand the failure of an entire Availability Zone. The Auto Scaling group automatically maintains the desired instance count across the specified zones, providing fault tolerance and high availability.

Answer

Use a larger EC2 instance type to handle failures.

Answer

Use a single Availability Zone to reduce latency.

Question 4

Refer to the exhibit. An IAM policy is attached to a user. When the user tries to upload an object to the S3 bucket 'my-bucket' using the AWS CLI without specifying server-side encryption, the upload fails. What is the MOST likely reason?

Accepted Answer

The policy requires server-side encryption with AES256, but the request did not include the encryption header.. The IAM policy explicitly requires the `s3:x-amz-server-side-encryption` condition with a value of `AES256`. When the user uploads an object via the AWS CLI without specifying the `--server-side-encryption AES256` flag, the request lacks the required encryption header, causing the condition in the policy to fail and the upload to be denied. The policy does not deny all uploads without encryption—it only denies those that fail to meet the specific encryption requirement.

Answer

The bucket policy denies all uploads without encryption.

Answer

The user is not the bucket owner.

Answer

The user does not have permission to call s3:PutObject.

Question 5

Refer to the exhibit. A solutions architect is designing a new application that requires three EC2 instances running in different Availability Zones in us-east-1. The architect runs the AWS CLI command shown and sees three instances running in three AZs. However, the application is not highly available because if one AZ fails, the application loses one-third of its capacity. The architect needs to ensure that the application can survive the loss of an entire AZ without manual intervention. What should the architect do?

Accepted Answer

Create an Auto Scaling group with a minimum size of 2 and a maximum size of 6, spread across three AZs.. An Auto Scaling group with a minimum size of 2 and a maximum size of 6, spread across three Availability Zones, ensures that if one AZ fails, the Auto Scaling group automatically launches replacement instances in the remaining healthy AZs to maintain the desired capacity. This provides fault tolerance without manual intervention, as the group continuously monitors instance health and replaces failed instances across AZs.

Answer

Create a launch configuration and manually associate it with the instances.

Answer

Use EC2 Auto Recovery to automatically recover instances in case of failure.

Answer

Manually launch additional instances in other AZs.

Question 6

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that users' session data be stored durably and with low latency. The session data is accessed frequently but is rarely updated. Which solution is MOST cost-effective?

Accepted Answer

Use ElastiCache for Redis with replication.. ElastiCache for Redis with replication is the most cost-effective solution because it provides durable, low-latency session storage with built-in replication for high availability. Redis supports persistence (e.g., snapshots or AOF logs) to ensure session data survives node failures, and its in-memory nature delivers sub-millisecond latency for frequent reads with rare updates, avoiding the higher costs of DynamoDB on-demand or the lack of durability in Memcached.

Answer

Store session data in Amazon S3 with reduced redundancy.

Answer

Use DynamoDB with on-demand capacity.

Answer

Use ElastiCache for Memcached with multiple nodes.

Question 7

A company is designing a multi-region active-active architecture for a web application using Amazon Route 53 latency-based routing. The application runs on EC2 instances in Auto Scaling groups with Application Load Balancers in each region. The application uses an Amazon Aurora global database for its data tier. The architecture must provide the lowest possible RTO and RPO for regional failures. What should the company do to meet these requirements?

Accepted Answer

Use the Aurora Global Database failover capability to promote the secondary region to primary.. Amazon Aurora Global Database provides a managed cross-Region failover capability that can promote a secondary region to primary with an RTO of as low as 1 minute and an RPO of typically less than 1 second, meeting the lowest possible RTO and RPO requirements for regional failures in an active-active architecture. This is achieved through storage-level replication that is asynchronous but very low latency, and the failover operation is a single API call or can be automated via Route 53 health checks, ensuring minimal data loss and downtime.

Answer

Configure Amazon RDS for MySQL with a cross-Region read replica and automatic failover.

Answer

Use Route 53 health checks to detect regional failure and automatically update the Aurora Global Database endpoint.

Answer

Use Amazon RDS Multi-AZ with synchronous replication across Regions.

Question 8

A company is designing a serverless data processing pipeline using AWS Lambda functions. The pipeline processes messages from an Amazon SQS queue. Each message takes approximately 30 seconds to process, and the pipeline must handle bursts of up to 10,000 messages per minute. The messages must be processed in the order they are received. Which solution meets these requirements?

Accepted Answer

Use an SQS FIFO queue with a Lambda function configured with a reserved concurrency of 1000.. An SQS FIFO queue guarantees first-in-first-out delivery within each message group, and with multiple message group IDs, messages can be processed in parallel. The Lambda function can be configured with a batch size of up to 10 messages from the same group. Assuming that messages are distributed across many groups, each invocation processes a batch of messages in approximately 30 seconds, yielding a per-group throughput of up to 20 messages per minute. With a reserved concurrency of 1000, the pipeline can handle up to 1000 groups concurrently, achieving a total throughput of 20,000 messages per minute, which exceeds the required burst of 10,000 messages per minute. Reserved concurrency also ensures that the necessary capacity is available when needed, preventing throttling.

Answer

Use an SQS FIFO queue with a Lambda function that sets the Concurrency limit to 100.

Answer

Use an SQS Standard queue with a Lambda function that processes messages in batches.

Answer

Use an Amazon Kinesis Data Stream with a Lambda function that processes multiple records per invocation.

Question 9

A company is designing a hybrid cloud solution that extends its on-premises data center to AWS. The company has a 10 Gbps AWS Direct Connect connection and needs to securely connect multiple VPCs and on-premises networks with transitive routing. The solution must be highly available and use AWS managed services. Which TWO components should the company include in the design? (Choose TWO.)

Accepted Answer

AWS Transit Gateway with attachments for each VPC and the Direct Connect Gateway.. AWS Transit Gateway provides transitive routing between multiple VPCs and on-premises networks, eliminating the need for complex peering meshes. Option E is correct because attaching a Direct Connect Gateway to the Transit Gateway allows the single 10 Gbps Direct Connect connection to be shared across all attached VPCs, enabling centralized, highly available connectivity.

Answer

AWS Global Accelerator endpoints in each VPC.

Answer

AWS Site-to-Site VPN connections from on-premises to each VPC.

Answer

VPC peering between each VPC and the on-premises network.

Question 10

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to store files in Amazon S3. The company has a strict security requirement that the application must not have any long-term credentials stored in the container image or environment variables. Which THREE steps should the company take to meet this requirement? (Choose THREE.)

Accepted Answer

Create an IAM role with permissions to access the S3 bucket.. The application must not have long-term credentials stored in the container image or environment variables. By creating an IAM role with permissions to access the S3 bucket and attaching it as the ECS task role (Option C), the application can obtain temporary credentials from the ECS task metadata endpoint. This eliminates the need to store any static access keys. Option D is also correct because the ECS task execution role must have the `iam:PassRole` permission to allow the task role to be associated with the container, enabling the credential retrieval mechanism.

Answer

Store AWS access keys in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure the application to use the AWS CLI with environment variables for credentials.

Question 11

A CloudFormation stack creation failed with the status shown in the exhibit. The stack was created using a template that defines an EC2 instance, a security group, and an Elastic IP address. What is the MOST likely cause of the failure?

Accepted Answer

The AWS account has reached the Elastic IP address limit.. The stack creation failed with a status that indicates a resource creation failure, and the most likely cause is that the AWS account has reached its Elastic IP address limit. Each AWS account has a default limit of 5 Elastic IP addresses per region, and attempting to create a new Elastic IP beyond this quota causes the CloudFormation stack to roll back. The error message in the exhibit (not shown here but implied) typically states 'The maximum number of addresses has been reached' or similar, confirming this as the root cause.

Answer

The security group rule is invalid.

Answer

The EC2 instance failed to associate with the Elastic IP.

Answer

The EC2 instance type is not supported in the region.

Question 12

A company has three EC2 instances as shown in the exhibit. The company wants to use an Application Load Balancer to distribute traffic across these instances with cross-zone load balancing enabled. How will the traffic be distributed?

Accepted Answer

Each instance receives an equal share of traffic.. With cross-zone load balancing enabled on an Application Load Balancer, traffic is distributed evenly across all registered targets regardless of the availability zone they reside in. Since there are three EC2 instances, each instance receives an equal share (33.3%) of the incoming traffic, ensuring balanced load across all instances.

Answer

Traffic is distributed evenly across the two availability zones.

Answer

Instances in us-east-1a receive 67% of traffic, us-east-1b receives 33%.

Answer

Traffic is sent to the instance with the least outstanding requests.

Question 13

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other using REST APIs. The company wants to implement a service mesh to handle traffic routing, observability, and security. Which AWS service should the company use?

Accepted Answer

AWS App Mesh.. AWS App Mesh is a service mesh that provides application-level networking, enabling traffic routing, observability (metrics, logs, traces), and security (mTLS, authorization policies) for microservices. It integrates natively with Amazon ECS on Fargate, allowing sidecar Envoy proxies to handle inter-service communication without modifying application code.

Answer

Elastic Load Balancing for internal network load balancers.

Answer

AWS Cloud Map for service discovery.

Answer

Amazon API Gateway with VPC linking.

Question 14

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data lake will ingest data from multiple sources, including streaming data from Amazon Kinesis Data Streams and batch data from on-premises systems via AWS Snowball. The company needs to catalog the data and make it available for querying with Amazon Athena and Amazon Redshift Spectrum. Which combination of services should the company use to meet these requirements?

Accepted Answer

Use AWS Glue to create a data catalog and run ETL jobs for both streaming and batch data.. AWS Glue provides a fully managed data catalog that integrates with Amazon Athena and Amazon Redshift Spectrum, making it the central metadata repository for the data lake. It can run ETL jobs for both streaming data (via Glue Streaming ETL) and batch data (via Glue Crawlers and Jobs), satisfying the requirement to catalog and prepare data from Kinesis Data Streams and Snowball. This combination directly meets the need for a unified catalog and query readiness.

Answer

Use AWS Lake Formation to set up the data lake and use its built-in catalog.

Answer

Use Amazon Athena to create tables and partitions directly from S3.

Answer

Use Amazon Kinesis Data Firehose to deliver streaming data to S3 and catalog with Athena.

Question 15

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket. The company wants to use a custom domain name and SSL/TLS termination. Which THREE services should the company use together to meet these requirements? (Choose THREE.)

Accepted Answer

Amazon CloudFront with an S3 origin.. Amazon CloudFront with an S3 origin is correct because CloudFront is a global content delivery network (CDN) that caches static content at edge locations, providing low-latency access worldwide. It also supports custom domain names via alternate domain names (CNAMEs) and integrates with AWS Certificate Manager (ACM) for SSL/TLS termination, meeting all requirements for hosting a static website with global performance and security.

Answer

AWS WAF to protect the website.

Answer

Application Load Balancer to distribute traffic across multiple S3 buckets.