SAP-C02 Design for New Solutions Practice Test 21 — 15 Questions

Question 1

A company has three EC2 instances as shown in the exhibit. The company wants to use an Application Load Balancer to distribute traffic across these instances with cross-zone load balancing enabled. How will the traffic be distributed?

Accepted Answer

Each instance receives an equal share of traffic.. With cross-zone load balancing enabled, the ALB distributes traffic evenly across all registered instances regardless of the availability zone. Each instance receives an equal share of traffic. Option B is correct. Option A is wrong because that is without cross-zone. Option C is wrong because it's not per AZ. Option D is wrong because it's not sticky.

Answer

Traffic is distributed evenly across the two availability zones.

Answer

Instances in us-east-1a receive 67% of traffic, us-east-1b receives 33%.

Answer

Traffic is sent to the instance with the least outstanding requests.

Question 2

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other using REST APIs. The company wants to implement a service mesh to handle traffic routing, observability, and security. Which AWS service should the company use?

Accepted Answer

AWS App Mesh.. AWS App Mesh is a service mesh that provides traffic management, observability, and security for microservices. Option C is correct. Option A is wrong because API Gateway is for external APIs. Option B is wrong because Cloud Map is for service discovery. Option D is wrong because ELB is a load balancer, not a service mesh.

Answer

Elastic Load Balancing for internal network load balancers.

Answer

AWS Cloud Map for service discovery.

Answer

Amazon API Gateway with VPC linking.

Question 3

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data lake will ingest data from multiple sources, including streaming data from Amazon Kinesis Data Streams and batch data from on-premises systems via AWS Snowball. The company needs to catalog the data and make it available for querying with Amazon Athena and Amazon Redshift Spectrum. Which combination of services should the company use to meet these requirements?

Accepted Answer

Use AWS Glue to create a data catalog and run ETL jobs for both streaming and batch data.. AWS Glue provides a managed data catalog that integrates with Athena and Redshift Spectrum. Glue ETL can handle both streaming and batch data. Option B is correct. Option A is wrong because Athena does not catalog data. Option C is wrong because Lake Formation builds on Glue. Option D is wrong because Kinesis Data Firehose is for streaming only.

Answer

Use AWS Lake Formation to set up the data lake and use its built-in catalog.

Answer

Use Amazon Athena to create tables and partitions directly from S3.

Answer

Use Amazon Kinesis Data Firehose to deliver streaming data to S3 and catalog with Athena.

Question 4

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket. The company wants to use a custom domain name and SSL/TLS termination. Which THREE services should the company use together to meet these requirements? (Choose THREE.)

Accepted Answer

Amazon CloudFront with an S3 origin.. CloudFront can serve content from S3 globally, with custom domain and SSL. S3 is the origin. Route 53 manages DNS for the custom domain. Option A, B, and D are correct. Option C is wrong because ALB is not needed for static content. Option E is wrong because AWS WAF is for security, not required.

Answer

AWS WAF to protect the website.

Answer

Application Load Balancer to distribute traffic across multiple S3 buckets.

Question 5

A company is designing a disaster recovery solution for a critical application that runs on Amazon RDS for PostgreSQL. The application requires an RPO of 5 minutes and an RTO of 15 minutes. The primary database is in us-east-1. The recovery Region is us-west-2. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Configure a cross-Region read replica for the RDS PostgreSQL instance in us-west-2.. Aurora Global Database has RPO < 1 second and RTO < 1 minute. Cross-Region read replicas have RPO of seconds and can be promoted in minutes. Option A and Option C are correct. Option B is wrong because Multi-AZ is single-Region. Option D is wrong because RDS does not support cross-Region automated backups. Option E is wrong because snapshot restore takes longer than 15 minutes.

Answer

Take manual snapshots periodically and copy them to us-west-2.

Answer

Enable Multi-AZ deployment in us-east-1 and use a read replica in us-west-2.

Answer

Use automated backups with cross-Region copy to us-west-2.

Question 6

A company is troubleshooting a Lambda function that is timing out when trying to connect to an RDS database in a VPC. The Lambda function configuration is shown in the exhibit. The function has a timeout of 30 seconds and a memory size of 128 MB. The VPC has subnets in multiple Availability Zones, but the function only has one subnet configured. What change will MOST LIKELY resolve the timeout?

Accepted Answer

Add subnets from other Availability Zones to the VPC configuration.. Lambda functions require subnets in multiple Availability Zones for high availability. With only one subnet, if that AZ becomes unavailable or the subnet lacks a NAT gateway for internet access, the function may fail. Adding subnets from multiple AZs improves availability. Option B is correct. Option A is wrong because increasing memory may help performance but not connectivity. Option C is wrong because VPC is needed for RDS. Option D is wrong because the security group may be correct.

Answer

Remove the VPC configuration to allow the function to access the internet.

Answer

Increase the function's memory size to 1024 MB.

Answer

Update the security group to allow all outbound traffic.

Question 7

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

Accepted Answer

Include the x-amz-server-side-encryption header with value aws:kms in the upload request.. The bucket policy condition requires that the request includes the header 'x-amz-server-side-encryption' with value 'aws:kms' for PutObject. Users must specify SSE-KMS encryption in their upload request. Option C is correct. Option A is wrong because the bucket policy already allows. Option B is wrong because the role policy allows it. Option D is wrong because KMS key permission is not the issue.

Answer

Remove the condition from the bucket policy.

Answer

Add an IAM policy that allows s3:PutObject to the role.

Answer

Grant the role permission to use the KMS key.

Question 8

A company is designing a serverless application using AWS Lambda to process incoming files from Amazon S3. Each file is less than 1 MB and processing must complete within 10 seconds. The application must handle bursts of up to 1,000 concurrent invocations. Which configuration will provide the MOST cost-effective solution?

Accepted Answer

Set function memory to 128 MB and leave concurrency at the account default of 1,000.. Lambda concurrency limit of 1,000 and function memory of 128 MB is sufficient for small files and cost-effective. Option A (reserved concurrency) may waste resources. Option C (provisioned concurrency) incurs extra cost. Option D (VPC) adds unnecessary network cost.

Answer

Use provisioned concurrency for 1,000 concurrent executions with 128 MB memory.

Answer

Place the Lambda function in a VPC with 1,024 MB memory for faster processing.

Answer

Set reserved concurrency to 1,000 and function memory to 256 MB.

Question 9

A company is designing a multi-region disaster recovery solution for a stateful web application on Amazon EC2 with an Amazon Aurora MySQL database. The RPO must be less than 1 second and RTO less than 5 minutes. The application uses a custom TCP port 8080. What is the MOST cost-effective architecture?

Accepted Answer

Use Amazon Aurora Global Database. Use Amazon Route 53 failover routing with a health check on port 8080.. Amazon Aurora Global Database provides replication with sub-second RPO. Route 53 failover routing with health checks on port 8080 enables fast RTO. Option A (cross-region read replica) has higher RPO. Option C (RDS Multi-AZ) is single-region. Option D (Application Load Balancer) is not cross-region.

Answer

Use Amazon RDS Multi-AZ with synchronous replication. Use Elastic Load Balancing with cross-zone load balancing.

Answer

Use Amazon DynamoDB global tables. Use an Application Load Balancer in each region with Route 53 weighted routing.

Answer

Use Amazon RDS for MySQL with a cross-region read replica. Use Amazon Route 53 failover routing with a health check on port 8080.

Question 10

A company is building a microservices architecture on Amazon ECS with Fargate. Each service must be isolated and communicate only via APIs. The company needs to enforce that services cannot directly access each other's databases. Which approach should be used?

Accepted Answer

Create a separate VPC for each service and use VPC peering for API communication only.. Placing each service in its own VPC with VPC peering (Option B) provides network isolation and controlled access. Option A (same VPC) does not isolate databases. Option C (security groups) is less granular. Option D (IAM roles) does not prevent network access.

Answer

Use a single VPC with network ACLs to block database ports between services.

Answer

Use IAM policies to restrict database access at the API level.

Answer

Place all services in the same VPC and use security groups to restrict database access.

Question 11

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must maintain session state. The company expects steady traffic with occasional spikes. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. ElastiCache for Redis provides a centralized, scalable session store decoupled from EC2. Option A (sticky sessions) is less scalable. Option C (ElastiCache Memcached) is also viable but Redis is preferred for persistence. Option D (DynamoDB) is more expensive for session data.

Answer

Use sticky sessions (session affinity) on the ALB with a session cookie.

Answer

Use Amazon ElastiCache for Memcached to store session data.

Answer

Store session data in Amazon DynamoDB tables.

Question 12

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

Accepted Answer

Use a Network Load Balancer with TCP listener and route traffic based on destination port to different target groups.. Networking Load Balancer with TCP listener and target groups allows routing based on protocol without modifying clients. Option A (ALB) requires HTTP. Option C (API Gateway) requires REST. Option D (AWS Global Accelerator) uses anycast IP but still needs TCP routing.

Answer

Use AWS Global Accelerator with a TCP listener and endpoint groups for microservices.

Answer

Use an Application Load Balancer with path-based routing to direct traffic to separate microservices.

Answer

Use Amazon API Gateway with a custom authorizer to route requests to AWS Lambda functions.

Question 13

A company needs to store application logs for at least one year with the ability to query them occasionally. The logs are generated at a rate of 10 GB per day. Which storage solution is MOST cost-effective?

Accepted Answer

Stream logs to Amazon S3 using Amazon Kinesis Data Firehose, then use S3 Lifecycle policies to transition to S3 Standard-IA after 30 days.. Amazon S3 with S3 Intelligent-Tiering or S3 Standard-IA is cost-effective for infrequent access. Option A (CloudWatch Logs) is expensive for long-term storage. Option C (S3 Glacier) has retrieval delays. Option D (EBS) is not suitable for logs.

Answer

Store logs on Amazon EBS volumes attached to a single EC2 instance for querying.

Answer

Store logs in Amazon S3 Glacier and use S3 Select to query directly.

Answer

Stream logs to Amazon CloudWatch Logs and set a retention policy of 365 days.

Question 14

A company is designing a hybrid cloud architecture that requires low-latency connectivity between on-premises and AWS. The company has multiple branch offices connecting to a central data center. The data center must be connected to AWS with 10 Gbps throughput and high availability. Which solution should the company choose?

Accepted Answer

Order two AWS Direct Connect connections from different providers and configure them in a LAG.. AWS Direct Connect with multiple connections provides dedicated, consistent throughput and high availability. Option A (VPN) is lower throughput. Option C (VPN over Internet) is not dedicated. Option D (Transit Gateway) is for managing multiple VPCs, not the primary connection.

Answer

Use AWS Transit Gateway to connect multiple VPCs to on-premises via a single VPN.

Answer

Use a single AWS Direct Connect connection with a backup VPN over the internet.

Answer

Set up multiple AWS Site-to-Site VPN connections from the data center to the VPC.

Question 15

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

Accepted Answer

Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.. AWS KMS with customer-managed CMKs provides encryption control. AWS CloudTrail logs all API calls including KMS decrypt operations. Option A (SSE-S3) does not use customer keys. Option C (CloudWatch) does not audit access. Option D (S3 server access logs) does not capture KMS usage.

Answer

Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.

Answer

Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.

Answer

Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.