SAP-C02 Design for New Solutions Practice Test 22 — 15 Questions

Question 1

A company is troubleshooting a Lambda function that is timing out when trying to connect to an RDS database in a VPC. The Lambda function configuration is shown in the exhibit. The function has a timeout of 30 seconds and a memory size of 128 MB. The VPC has subnets in multiple Availability Zones, but the function only has one subnet configured. What change will MOST LIKELY resolve the timeout?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add subnets from other Availability Zones to the VPC configuration.. The Lambda function is timing out because it is configured with only one subnet, but the RDS database is in a VPC with subnets across multiple Availability Zones (AZs). Lambda requires at least one subnet per AZ used by the target resource to ensure network path availability; if the single subnet's AZ becomes unavailable or the RDS instance is in a different AZ, the connection fails. Adding subnets from other AZs provides redundant network paths, resolving the timeout.

Answer

Remove the VPC configuration to allow the function to access the internet.

Answer

Increase the function's memory size to 1024 MB.

Answer

Update the security group to allow all outbound traffic.

Question 2

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

Accepted Answer

Include the x-amz-server-side-encryption header with value aws:kms in the upload request.. The bucket policy includes a condition that requires the `x-amz-server-side-encryption` header to be set to `aws:kms` for `s3:PutObject` operations. When users assume the cross-account role and upload objects without specifying encryption, the request fails because it does not satisfy this condition. Including the `x-amz-server-side-encryption: aws:kms` header in the upload request explicitly meets the condition, allowing the upload to succeed.

Answer

Remove the condition from the bucket policy.

Answer

Add an IAM policy that allows s3:PutObject to the role.

Answer

Grant the role permission to use the KMS key.

Question 3

A company is designing a serverless application using AWS Lambda to process incoming files from Amazon S3. Each file is less than 1 MB and processing must complete within 10 seconds. The application must handle bursts of up to 1,000 concurrent invocations. Which configuration will provide the MOST cost-effective solution?

Accepted Answer

Set function memory to 128 MB and leave concurrency at the account default of 1,000.. The default account-level concurrency limit is 1,000 concurrent executions, which meets the burst requirement without additional cost. With files under 1 MB and a 10-second timeout, 128 MB memory is sufficient for lightweight processing, and provisioned or reserved concurrency would incur unnecessary charges since the workload is sporadic and does not require pre-warmed instances.

Answer

Use provisioned concurrency for 1,000 concurrent executions with 128 MB memory.

Answer

Place the Lambda function in a VPC with 1,024 MB memory for faster processing.

Answer

Set reserved concurrency to 1,000 and function memory to 256 MB.

Question 4

A company is designing a multi-region disaster recovery solution for a stateful web application on Amazon EC2 with an Amazon Aurora MySQL database. The RPO must be less than 1 second and RTO less than 5 minutes. The application uses a custom TCP port 8080. What is the MOST cost-effective architecture?

Accepted Answer

Use Amazon Aurora Global Database. Use Amazon Route 53 failover routing with a health check on port 8080.. Amazon Aurora Global Database provides cross-region replication with a typical lag of under 1 second, meeting the RPO requirement, and supports failover in under 1 minute, satisfying the RTO of less than 5 minutes. Combined with Route 53 failover routing and a health check on port 8080, this architecture enables rapid, automated traffic redirection to the secondary region without additional compute or storage costs beyond the Aurora storage and I/O.

Answer

Use Amazon RDS Multi-AZ with synchronous replication. Use Elastic Load Balancing with cross-zone load balancing.

Answer

Use Amazon DynamoDB global tables. Use an Application Load Balancer in each region with Route 53 weighted routing.

Answer

Use Amazon RDS for MySQL with a cross-region read replica. Use Amazon Route 53 failover routing with a health check on port 8080.

Question 5

A company is building a microservices architecture on Amazon ECS with Fargate. Each service must be isolated and communicate only via APIs. The company needs to enforce that services cannot directly access each other's databases. Which approach should be used?

Accepted Answer

Create a separate VPC for each service and use VPC peering for API communication only.. Placing each microservice in its own VPC and using VPC peering for API communication only enforces strict network isolation at the VPC boundary. This prevents any direct database access between services, as the peering connection can be configured to allow only specific API ports (e.g., HTTPS 443) and not database ports (e.g., 3306, 5432). This design aligns with the principle of least privilege and ensures that services cannot bypass API gateways to reach each other's databases.

Answer

Use a single VPC with network ACLs to block database ports between services.

Answer

Use IAM policies to restrict database access at the API level.

Answer

Place all services in the same VPC and use security groups to restrict database access.

Question 6

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must maintain session state. The company expects steady traffic with occasional spikes. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Amazon ElastiCache for Redis provides a highly scalable, low-latency, and durable external session store that decouples session state from EC2 instances. This allows the Auto Scaling group to add or remove instances freely without losing session data, and Redis supports replication and persistence for reliability. Compared to DynamoDB, Redis offers lower latency for session access, and compared to Memcached, it provides data structures and persistence that are beneficial for session management.

Answer

Use sticky sessions (session affinity) on the ALB with a session cookie.

Answer

Use Amazon ElastiCache for Memcached to store session data.

Answer

Store session data in Amazon DynamoDB tables.

Question 7

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

Accepted Answer

Use a Network Load Balancer with TCP listener and route traffic based on destination port to different target groups.. A Network Load Balancer (NLB) with a TCP listener can forward traffic based on destination port to different target groups, allowing the legacy client using a proprietary binary protocol over TCP to reach distinct microservices without any client-side changes. This preserves the existing TCP connection semantics and binary protocol, which an Application Load Balancer (HTTP/HTTPS only) or API Gateway (HTTP/REST) cannot handle.

Answer

Use AWS Global Accelerator with a TCP listener and endpoint groups for microservices.

Answer

Use an Application Load Balancer with path-based routing to direct traffic to separate microservices.

Answer

Use Amazon API Gateway with a custom authorizer to route requests to AWS Lambda functions.

Question 8

A company needs to store application logs for at least one year with the ability to query them occasionally. The logs are generated at a rate of 10 GB per day. Which storage solution is MOST cost-effective?

Accepted Answer

Stream logs to Amazon S3 using Amazon Kinesis Data Firehose, then use S3 Lifecycle policies to transition to S3 Standard-IA after 30 days.. Amazon Kinesis Data Firehose can stream logs directly to Amazon S3, and S3 Lifecycle policies allow automatic transition to S3 Standard-IA after 30 days, which reduces storage costs for infrequently accessed data while still allowing occasional queries. This combination meets the one-year retention requirement cost-effectively, as S3 Standard-IA has lower storage costs than S3 Standard for data accessed less frequently, and the lifecycle transition avoids manual intervention.

Answer

Store logs on Amazon EBS volumes attached to a single EC2 instance for querying.

Answer

Store logs in Amazon S3 Glacier and use S3 Select to query directly.

Answer

Stream logs to Amazon CloudWatch Logs and set a retention policy of 365 days.

Question 9

A company is designing a hybrid cloud architecture that requires low-latency connectivity between on-premises and AWS. The company has multiple branch offices connecting to a central data center. The data center must be connected to AWS with 10 Gbps throughput and high availability. Which solution should the company choose?

Accepted Answer

Order two AWS Direct Connect connections from different providers and configure them in a LAG.. The requirement for 10 Gbps throughput and high availability mandates using two AWS Direct Connect connections from different providers, configured as a Link Aggregation Group (LAG). LAG aggregates multiple connections into a single logical interface, providing both increased bandwidth and redundancy. A single Direct Connect connection with a backup VPN (Option B) would not meet the 10 Gbps throughput requirement, as VPNs are typically limited to lower bandwidth and introduce latency. Option A and C rely on VPNs, which cannot guarantee 10 Gbps throughput and may suffer from internet-based variability.

Answer

Use AWS Transit Gateway to connect multiple VPCs to on-premises via a single VPN.

Answer

Use a single AWS Direct Connect connection with a backup VPN over the internet.

Answer

Set up multiple AWS Site-to-Site VPN connections from the data center to the VPC.

Question 10

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

Accepted Answer

Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.. It uses SSE-KMS with a customer-managed CMK to meet the encryption-at-rest requirement with customer-controlled keys, and enables AWS CloudTrail with data events for both S3 and KMS to audit all access to the data lake. This combination provides granular auditing of every S3 object-level operation (e.g., GetObject, PutObject) and every KMS key usage (e.g., Decrypt, GenerateDataKey), which is essential for compliance and security monitoring.

Answer

Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.

Answer

Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.

Answer

Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.

Question 11

A company is deploying a web application on AWS that must scale automatically based on CPU utilization. The application runs on Amazon EC2 instances in an Auto Scaling group. Which configuration is required for the Auto Scaling group to scale based on CPU?

Accepted Answer

Create a step scaling policy based on a CloudWatch alarm for CPU utilization.. A step scaling policy allows the Auto Scaling group to adjust capacity in increments based on the severity of a CloudWatch alarm, such as one monitoring CPU utilization. This provides more granular and responsive scaling than simple policies, as it can add or remove instances in steps (e.g., add 2 instances when CPU > 70%, add 1 when CPU > 50%) and supports cooldown and warm-up logic to avoid thrashing.

Answer

Create a scheduled scaling action to add instances at peak times.

Answer

Create a simple scaling policy that adds one instance when CPU exceeds 50%.

Answer

Configure the ALB health check to mark instances unhealthy if CPU is high.

Question 12

A company is designing a solution to process real-time streaming data from IoT devices. The data must be ingested, processed with sub-second latency, and stored for analytics. Which services should the company use? (Choose TWO.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can process streaming data from Amazon Kinesis Data Streams with sub-second latency by subscribing to the stream as an event source. Lambda functions are invoked synchronously with each record, enabling real-time transformations or lightweight analytics before the data is stored.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Kinesis Data Firehose

Question 13

A company is designing a new application that will use Amazon S3 to store sensitive customer data. The data must be encrypted at rest and in transit. The company also needs to ensure that only authorized users can access the data. Which three steps should the company take? (Choose THREE.)

Accepted Answer

Enable S3 default encryption with SSE-KMS.. Enabling S3 default encryption with SSE-KMS ensures that all objects stored in the bucket are encrypted at rest using AWS Key Management Service (KMS) keys. This provides centralized key management, auditability via AWS CloudTrail, and the ability to enforce encryption policies without requiring client-side changes.

Answer

Use client-side encryption with a customer key.

Answer

Make the bucket publicly accessible for ease of access.

Question 14

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, elastic NFS file system that supports concurrent read/write access from thousands of EC2 instances across multiple Availability Zones. It is designed for high availability and scalability, automatically growing and shrinking as files are added or removed, making it ideal for a shared file system for user uploads in a migrated monolithic application.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3 with S3 File Gateway

Answer

Amazon EBS with Multi-Attach enabled

Question 15

A company is designing a serverless data processing pipeline using AWS Lambda to process messages from an Amazon SQS queue. The messages are generated by thousands of IoT devices. The architect needs to ensure that messages are processed in order within each device's stream and that failures are handled without data loss. Which combination of services should the architect use?

Accepted Answer

Use Amazon Kinesis Data Streams with Lambda function and a dead-letter queue. Amazon Kinesis Data Streams preserves the order of records within a shard, which maps to each device's stream when using a partition key like device ID. The Lambda function processes records from the stream, and a dead-letter queue captures any records that fail after the retry policy is exhausted, ensuring no data loss. This combination meets the requirements for ordered processing per device and fault tolerance without data loss.

Answer

Use Amazon Kinesis Data Firehose with Lambda function and an SQS queue for error handling

Answer

Use Amazon SQS standard queues with Lambda function and a dead-letter queue

Answer

Use Amazon SQS FIFO queues with Lambda function