SAP-C02 Design for New Solutions Practice Test 22 — 15 Questions

Question 1

A financial services company is designing a new multi-account AWS environment. Security policy requires that all Amazon S3 buckets across every account have server-side encryption with AWS KMS keys (SSE-KMS) enabled and that any attempt to disable encryption is blocked. The security team wants a centralized, preventive control that cannot be bypassed by account administrators. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 default encryption with AWS KMS keys on all buckets and attach an SCP that denies s3:PutBucketEncryption and s3:DeleteBucketEncryption to all accounts except the security account.. The requirement is for a centralized, preventive control that blocks disabling encryption. S3 default encryption with AWS KMS keys ensures encryption is always applied, and an SCP that denies s3:PutBucketEncryption and s3:DeleteBucketEncryption prevents any modification to encryption settings across all accounts. This is enforced at the AWS Organizations level, so account administrators cannot override it.

Answer

Attach an AWS Organizations service control policy (SCP) to the root that denies s3:PutBucketEncryption with a condition that the encryption algorithm is not aws:kms, and denies s3:PutBucketEncryption with a null key.

Answer

Create an AWS Config rule in each account that detects unencrypted S3 buckets and automatically remediates them using a remediation action.

Answer

Use an S3 bucket policy in each account that denies s3:PutBucketEncryption unless the request includes the s3:x-amz-server-side-encryption header set to aws:kms.

Question 2

A company is designing a new solution to process millions of small files uploaded to Amazon S3 each day. The files must be processed within minutes of upload, and the processing logic is CPU-intensive and takes 1–2 minutes per file. The company wants to minimize operational overhead and cost. Which solution should a solutions architect recommend?

Accepted Answer

Configure an S3 event notification to send messages to an Amazon SQS queue. Use an Amazon ECS service on AWS Fargate with a task that polls the queue and processes files.. Using Amazon SQS to decouple S3 event notifications from processing, combined with an Amazon ECS service on AWS Fargate, provides a scalable, serverless compute solution that handles CPU-intensive tasks. The ECS service can scale based on queue depth, ensuring timely processing of millions of files while minimizing operational overhead and cost, as Fargate charges only for the resources used.

Answer

Configure an S3 event notification to invoke an AWS Lambda function directly for each uploaded file.

Answer

Use AWS Batch with an S3 event notification to submit a job for each file. Configure the compute environment with EC2 On-Demand instances.

Answer

Configure an S3 event notification to send messages to an Amazon SQS queue. Use an AWS Lambda function to poll the queue and process each file.

Question 3

A company is designing a new solution that requires a highly available and durable object storage layer for storing millions of small files. The files are accessed frequently for the first 30 days and then rarely accessed. The company wants to minimize storage costs while ensuring that data is not lost. The company also requires that the data be encrypted at rest and in transit. Which solution should a solutions architect recommend?

Accepted Answer

Use Amazon S3 with a lifecycle policy to transition objects to S3 Standard-IA after 30 days, then to S3 Glacier Instant Retrieval after 90 days. Enable S3 server-side encryption with AWS KMS (SSE-KMS) and enforce TLS.. S3 Standard-IA and S3 Glacier Instant Retrieval offer lower storage costs for infrequently accessed data while maintaining high durability and millisecond access. A lifecycle policy automates transitions. SSE-KMS provides encryption at rest with customer-managed keys, and a bucket policy enforcing TLS ensures encryption in transit. This combination satisfies durability, cost, and security requirements.

Answer

Use Amazon S3 with a lifecycle policy to transition objects to S3 One Zone-IA after 30 days. Enable S3 server-side encryption with AWS KMS (SSE-KMS) and enforce TLS.

Answer

Use Amazon S3 with a lifecycle policy to transition objects to S3 Standard-IA after 30 days. Enable S3 server-side encryption with Amazon S3 managed keys (SSE-S3) and enforce TLS.

Answer

Use Amazon S3 Standard for all objects, and enable S3 server-side encryption with AWS KMS (SSE-KMS). Enforce TLS for all requests using a bucket policy.

Question 4

A company is designing a new serverless application that processes orders. The application uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The company needs to ensure that orders are processed exactly once and that failed orders are retried automatically. The solution must also handle sudden spikes in traffic without losing messages. Which design should a solutions architect recommend?

Accepted Answer

API Gateway sends orders to an Amazon SQS FIFO queue. A Lambda function processes messages from the queue and writes to DynamoDB using a conditional write based on a unique order ID. The queue is configured with a dead-letter queue.. The combination of an SQS FIFO queue, a Lambda function that processes messages, and DynamoDB conditional writes based on a unique order ID ensures exactly-once processing. SQS FIFO deduplicates messages and maintains order, while the dead-letter queue handles persistent failures. SQS buffers traffic spikes, and Lambda scales automatically to process messages, so sudden increases in order volume do not result in lost messages.

Answer

API Gateway sends orders to an Amazon SNS topic. The topic fans out to an Amazon SQS standard queue. A Lambda function processes messages from the queue and writes to DynamoDB with conditional writes to ensure idempotency.

Answer

API Gateway sends orders to an Amazon SQS FIFO queue. A Lambda function polls the queue and writes to DynamoDB. The queue is configured with a dead-letter queue for failed messages.

Answer

API Gateway integrates directly with Lambda. Lambda writes to DynamoDB and uses DynamoDB Streams to trigger another Lambda function for retries.

Question 5

A logistics company is designing a new event-driven system for package tracking. Events are produced by thousands of IoT devices and must be processed in order per package. The system must retain events for up to 24 hours so that a downstream analytics application can replay them if needed. The company wants to minimize operational overhead and avoid managing servers. Which solution should a solutions architect recommend?

Accepted Answer

Use Amazon Kinesis Data Streams with a partition key of the package ID, and configure the retention period to 24 hours. Have the analytics application use the Kinesis Client Library to process the stream.. The need for ordered processing per package and the ability to replay events for 24 hours points to Kinesis Data Streams. Using the package ID as the partition key keeps related events on the same shard, and the 24-hour retention allows replay. The Kinesis Client Library simplifies processing and eliminates server management, meeting both the technical and operational requirements.

Answer

Use Amazon MSK with a topic partitioned by package ID, and set the retention period to 24 hours. Have the analytics application use a Kafka consumer group.

Answer

Use Amazon SQS FIFO queues with a message group ID of the package ID, and set the message retention period to 24 hours. Have the analytics application poll the queue.

Answer

Use Amazon EventBridge with an event bus and a rule that routes events to an AWS Lambda function. Enable archive and replay on the event bus for 24 hours.

Question 6

A financial services company is building a new payment processing platform that must expose a single global HTTPS endpoint to customers. Compliance rules require that TLS certificates and private keys never leave AWS-managed hardware security modules, and the platform must continue serving traffic if an entire AWS Region becomes unavailable. Which combination of services should a solutions architect use?

Accepted Answer

AWS Global Accelerator with two endpoint groups in different Regions, each containing an Application Load Balancer that uses an ACM certificate, plus Route 53 failover records for the accelerator's static anycast IP addresses.. A single global HTTPS entry point with Region-level failover is best delivered by AWS Global Accelerator, whose static anycast IP addresses route clients to healthy endpoint groups. Terminating TLS on Application Load Balancers keeps certificates and private keys inside AWS Certificate Manager, where keys are protected by AWS-managed HSMs and never exportable, satisfying the compliance constraint.

Answer

Amazon CloudFront with an AWS Certificate Manager (ACM) certificate in us-east-1, an Application Load Balancer in two Regions, and AWS Global Accelerator for health-check-based failover.

Answer

AWS Global Accelerator with an ACM certificate on the accelerator, endpoints in two Regions, and a Network Load Balancer in each Region as the endpoint group.

Answer

Amazon Route 53 latency-based records pointing to Application Load Balancers in two Regions, with TLS certificates imported into AWS Certificate Manager in each Region.

Question 7

A media company is designing a new video transcoding pipeline. The pipeline will receive large video files in an Amazon S3 bucket, transcode them using a fleet of Amazon EC2 Spot Instances, and store the output in another S3 bucket. The company wants to minimize the cost of the EC2 instances and ensure that transcoding jobs are not lost if an instance is interrupted. Which design should the company use?

Accepted Answer

Use an Amazon SQS queue with a visibility timeout set to the maximum expected transcoding time. EC2 Spot Instances poll the queue, process jobs, and delete messages upon completion. Configure the instances to use a Spot Fleet with a capacity-optimized allocation strategy.. The key requirements are to minimize cost and ensure jobs are not lost. Using SQS with a visibility timeout set to the maximum transcoding time prevents duplicate processing and ensures that if an instance is interrupted, the message becomes available for another instance. The capacity-optimized allocation strategy for Spot Fleet chooses instance pools with the most capacity, reducing interruption frequency and often lowering cost. This combination provides a reliable, cost-effective solution.

Answer

Use an Amazon SQS FIFO queue to store transcoding jobs. EC2 Spot Instances poll the queue, process jobs, and delete messages upon completion. Configure the instances to use a Spot Fleet with the lowest-price allocation strategy.

Answer

Use an Amazon SQS queue to store transcoding jobs. EC2 Spot Instances poll the queue, process jobs, and delete messages upon completion. Configure the instances to use a Spot Fleet with a diversified allocation strategy across multiple instance types and Availability Zones.

Answer

Use an Amazon SQS standard queue with a short visibility timeout. EC2 Spot Instances poll the queue, process jobs, and delete messages upon completion. Configure the instances to use a Spot Fleet with the lowest-price allocation strategy and enable termination protection.

Question 8

A retail company is building a new order-management system that must expose a GraphQL API to mobile clients and a REST API to partner systems. Both APIs must share the same business logic and data model, and the company wants to minimize the number of backend services it operates. The mobile clients are frequently offline and need to resolve conflicts when they reconnect, and the company wants the API layer to handle authentication and per-field authorization. Which AWS service combination should the solutions architect recommend?

Accepted Answer

AWS AppSync with a single GraphQL schema, resolvers backed by Amazon DynamoDB, and API Gateway REST APIs invoking the same Lambda data-access layer. The requirement is one business logic and data model exposed through two API styles, with managed authentication and mobile offline support. AWS AppSync provides managed GraphQL with built-in conflict resolution, offline sync, and field-level authorization, and its resolvers can reuse the same data-access layer that API Gateway REST endpoints expose to partners. This keeps a single backend surface and minimizes the services the company must run.

Answer

Amazon API Gateway HTTP APIs with a single AWS Lambda function that parses GraphQL queries from a POST body and returns JSON

Answer

An Application Load Balancer routing to containers on Amazon ECS that run an open-source GraphQL server and a separate REST server, each with its own data store

Answer

Amazon API Gateway REST APIs for both interfaces, with AWS Lambda functions per resource and authorization handled inside each function

Question 9

A logistics company runs a nightly batch job that reads 40 TB of data from an Amazon S3 bucket in us-east-1 and processes it on a fleet of Amazon EC2 instances using Apache Spark. The job currently takes 9 hours and must complete within a 4-hour maintenance window. The data is already in S3 and the company does not want to change the application code. Which change should the solutions architect make to meet the time requirement MOST cost-effectively?

Accepted Answer

Enable S3 Transfer Acceleration on the bucket and increase the number of EC2 instances in the fleet. Transfer Acceleration routes S3 traffic through AWS edge locations and the AWS backbone, which raises per-stream throughput for large parallel reads, and adding EC2 instances increases aggregate bandwidth across the fleet. Together these reduce the job wall-clock time without modifying the Spark application or paying for a persistent high-performance file system.

Answer

Migrate the Spark job to AWS Glue and rely on Glue's automatic scaling to reduce runtime

Answer

Copy the data to Amazon EBS gp3 volumes attached to each instance before processing

Answer

Move the data to an Amazon FSx for Lustre file system linked to the S3 bucket and have the Spark job read from the file system

Question 10

A healthcare company must give an on-premises analytics cluster read access to a large dataset stored in Amazon S3. Security policy forbids traffic from traversing the public internet, requires that the data never be cached on disk outside the company's control, and mandates that access be granted without creating AWS Identity and Access Management users for the analytics servers. Which solution meets these requirements?

Accepted Answer

Set up an AWS Site-to-Site VPN to a VPC, create an S3 gateway endpoint, and configure the analytics cluster to use AWS IAM Roles Anywhere with X.509 certificates issued by the company's certificate authority.. IAM Roles Anywhere issues temporary credentials to on-premises servers that present certificates from a trusted certificate authority, eliminating IAM users and static keys. Pairing it with an S3 gateway endpoint reached over a Site-to-Site VPN keeps object traffic on private connectivity, and direct S3 reads avoid any local caching outside the company's control.

Answer

Enable S3 Transfer Acceleration on the bucket and provide the analytics cluster with presigned URLs generated by an AWS Lambda function on a schedule.

Answer

Create an IAM user for each analytics server, store the access keys in the cluster's configuration, and connect to S3 over the public endpoint using HTTPS.

Answer

Deploy an AWS Storage Gateway file gateway in the VPC, mount the SMB share on the analytics cluster, and rely on the gateway's local cache for reads.

Question 11

A company is designing a new global e-commerce platform that will use Amazon DynamoDB as its primary database. The platform must provide fast read performance for users worldwide and must be able to handle a sudden surge in write traffic during flash sales. The company wants to minimize operational overhead and ensure the database can automatically scale to meet demand. Which design should the company use?

Accepted Answer

Use a DynamoDB global table with on-demand capacity mode. Configure the table to replicate to multiple AWS Regions and enable DynamoDB Accelerator (DAX) in each Region for read caching, while using write sharding to distribute write traffic across multiple partitions.. The platform needs fast global reads and the ability to handle sudden write surges with minimal overhead. On-demand capacity mode automatically scales, global tables provide multi-Region replication, DAX accelerates reads, and write sharding distributes write load to avoid hot partitions. Together, these features meet the performance and scalability requirements without manual capacity planning.

Answer

Use a DynamoDB global table with provisioned capacity mode and Auto Scaling. Configure the table to replicate to multiple AWS Regions and set up a global secondary index (GSI) for read queries.

Answer

Use a DynamoDB global table with on-demand capacity mode. Configure the table to replicate to multiple AWS Regions and use Amazon DynamoDB Streams to trigger AWS Lambda functions that update a read-optimized cache in each Region.

Answer

Use a DynamoDB global table with on-demand capacity mode. Configure the table to replicate to multiple AWS Regions and enable DynamoDB Accelerator (DAX) in each Region for read caching.

Question 12

A company is designing a new multi-tenant SaaS platform on AWS. Each tenant's data must be isolated in its own AWS account, tenants must be able to bring their own encryption keys, and new tenant accounts must be provisioned automatically with a standardized security baseline. The operations team wants central visibility into findings across all tenant accounts. Which combination of services should a solutions architect recommend?

Accepted Answer

AWS Control Tower with an Account Factory custom template, AWS Key Management Service external key stores for tenant keys, and AWS Security Hub with a delegated administrator account.. AWS Control Tower with Account Factory provisions new tenant accounts against a standardized baseline, and Security Hub with a delegated administrator aggregates findings centrally. AWS KMS external key stores let tenants retain control of key material in their own external key manager, meeting the bring-your-own-key requirement while keeping cryptographic operations inside AWS KMS.

Answer

AWS Service Catalog portfolios shared from a central account, Amazon Macie for encryption key management, and AWS Config conformance packs evaluated in each tenant account separately.

Answer

AWS Resource Access Manager to share a single KMS customer managed key with every tenant account, AWS CloudFormation StackSets for baseline deployment, and Amazon GuardDuty findings exported to each tenant's own console.

Answer

AWS Organizations with a service control policy that denies all actions outside the tenant Region, plus AWS CloudTrail organization trails delivering to a central bucket.

Question 13

A healthcare company is designing a new application that must store and retrieve sensitive patient data in Amazon DynamoDB. The data must be encrypted at rest using a customer managed key in AWS KMS, and the company wants to ensure that only authorized application roles can decrypt the data. The application runs on Amazon EC2 instances with an IAM role. The security team wants to enforce that all DynamoDB tables in the account use the specified KMS key for encryption. What should be done to meet these requirements with the least effort?

Accepted Answer

Create a customer managed KMS key, configure the DynamoDB table to use it for encryption, and update the KMS key policy to allow the EC2 IAM role to decrypt.. Creating a customer managed KMS key and configuring the DynamoDB table to use it, along with a key policy that grants decrypt permissions to the EC2 IAM role, provides the required encryption and access control. This approach gives the company control over the key and ensures only authorized roles can access the data, with minimal effort.

Answer

Enable DynamoDB encryption at rest with the default key, and use AWS KMS grants to allow the EC2 IAM role to use the key.

Answer

Use AWS CloudFormation to deploy DynamoDB tables with the AWS::DynamoDB::Table resource and specify the SSESpecification with the KMS key ARN, and rely on IAM policies to control access to the key.

Answer

Create a DynamoDB table with encryption at rest using the default AWS managed key, and grant the EC2 IAM role permissions to use the key.

Question 14

A company is designing a new global web application that will be deployed in multiple AWS Regions. The application uses an Application Load Balancer (ALB) in each Region and needs to provide low-latency access to users worldwide. The company wants to route users to the closest healthy ALB and must support failover if an entire Region becomes unavailable. The solution must be highly available and require minimal operational overhead. Which service should be used to distribute traffic?

Accepted Answer

AWS Global Accelerator with endpoint groups for each ALB.. AWS Global Accelerator uses the AWS global network to route user traffic to the optimal Regional endpoint based on health, geography, and latency. It provides automatic failover and static anycast IPs, reducing operational overhead. This makes it ideal for global applications requiring low latency and high availability across multiple Regions.

Answer

Amazon Route 53 with latency-based routing and health checks for each ALB.

Answer

Amazon Route 53 with geolocation routing and health checks for each ALB.

Answer

Amazon CloudFront with the ALBs as custom origins and origin groups for failover.

Question 15

A company is designing a new application that will ingest large volumes of streaming data from millions of IoT devices. The data must be stored in Amazon S3 for long-term analysis and also processed in near real-time by AWS Lambda functions. The company wants to minimize operational overhead and ensure the solution can scale automatically. Which AWS service should be used to reliably ingest and buffer the streaming data before processing?

Accepted Answer

Amazon Data Firehose. Amazon Data Firehose is a fully managed service that can ingest streaming data at scale without provisioning. It buffers data and can deliver to S3 while simultaneously invoking Lambda for transformation. This meets the requirements for reliable ingestion, buffering, and near real-time processing with minimal operational overhead.

Answer

AWS IoT Analytics

Answer

Amazon SQS FIFO queue

Answer

Amazon Kinesis Data Streams