SAP-C02 Design for New Solutions Practice Test 22 — 15 Questions

Question 1

A company is deploying a web application on AWS that must scale automatically based on CPU utilization. The application runs on Amazon EC2 instances in an Auto Scaling group. Which configuration is required for the Auto Scaling group to scale based on CPU?

Accepted Answer

Create a step scaling policy based on a CloudWatch alarm for CPU utilization.. Create a CloudWatch alarm on average CPU utilization and a scaling policy. Option A (scheduled scaling) is for time-based. Option B (simple scaling) is not recommended. Option D (ELB health check) is for health, not scaling.

Answer

Create a scheduled scaling action to add instances at peak times.

Answer

Create a simple scaling policy that adds one instance when CPU exceeds 50%.

Answer

Configure the ALB health check to mark instances unhealthy if CPU is high.

Question 2

A company is designing a solution to process real-time streaming data from IoT devices. The data must be ingested, processed with sub-second latency, and stored for analytics. Which services should the company use? (Choose TWO.)

Accepted Answer

AWS Lambda. Amazon Kinesis Data Streams ingests streaming data with sub-second latency. AWS Lambda processes data in near real-time. Option C (Kinesis Data Firehose) is for loading to S3 with higher latency. Option D (SQS) is for message queuing. Option E (Kinesis Data Analytics) is for SQL analytics on streams.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Kinesis Data Firehose

Question 3

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by third-party APIs. The company plans to use an Application Load Balancer with EC2 instances. Which two steps should the company take to ensure the ALB has a consistent set of IP addresses? (Choose TWO.)

Accepted Answer

Place the ALB behind an AWS Global Accelerator.. Using AWS Global Accelerator provides two static anycast IP addresses. Associating the ALB with a WAF protects the application. Option B (NLB with EIP) is not required if using Global Accelerator. Option D (NAT Gateway) is for outbound traffic. Option E (Route 53) does not provide static IP.

Answer

Use a NAT Gateway with Elastic IPs for outbound traffic.

Answer

Place a Network Load Balancer with Elastic IP addresses in front of the ALB.

Answer

Use Amazon Route 53 with an A record pointing to the ALB.

Question 4

A company is designing a new application that will use Amazon S3 to store sensitive customer data. The data must be encrypted at rest and in transit. The company also needs to ensure that only authorized users can access the data. Which three steps should the company take? (Choose THREE.)

Accepted Answer

Enable S3 default encryption with SSE-KMS.. Enforce encryption in transit (HTTPS) via bucket policy. Enable S3 default encryption with SSE-KMS. Use bucket policies to restrict access to authorized principals. Option D (public access) is wrong. Option E (client-side encryption) is not required.

Answer

Use client-side encryption with a customer key.

Answer

Make the bucket publicly accessible for ease of access.

Question 5

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed, elastic NFS file system that supports concurrent access from multiple EC2 instances, making it ideal for shared file storage. Option A (S3) is object storage, not a file system. Option C (EBS) is block storage attached to a single instance. Option D (FSx for Windows File Server) is for Windows workloads but requires Windows instances.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3 with S3 File Gateway

Answer

Amazon EBS with Multi-Attach enabled

Question 6

A company is designing a serverless data processing pipeline using AWS Lambda to process messages from an Amazon SQS queue. The messages are generated by thousands of IoT devices. The architect needs to ensure that messages are processed in order within each device's stream and that failures are handled without data loss. Which combination of services should the architect use?

Accepted Answer

Use Amazon Kinesis Data Streams with Lambda function and a dead-letter queue. Amazon Kinesis Data Streams preserves the order of records within a shard, and Lambda can process records in order. For error handling, a DLQ captures failed records. Option A (SQS FIFO) provides ordering but does not support Lambda triggers with ordered processing per shard. Option B (Lambda with DLQ on SQS) does not guarantee ordering across multiple shards. Option D (Kinesis with SQS) adds unnecessary complexity.

Answer

Use Amazon Kinesis Data Firehose with Lambda function and an SQS queue for error handling

Answer

Use Amazon SQS standard queues with Lambda function and a dead-letter queue

Answer

Use Amazon SQS FIFO queues with Lambda function

Question 7

A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires that users' session data be stored and made available across all instances. Which solution is MOST cost-effective and scalable?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data. Amazon ElastiCache for Redis provides a distributed, in-memory cache that can store session data, is cost-effective, and scales easily. Option A (sticky sessions) couples the user to a specific instance, reducing fault tolerance. Option C (EBS) is not shared across instances. Option D (RDS) is overkill and slower for session data.

Answer

Store session data on an Amazon EBS volume attached to each instance

Answer

Store session data in an Amazon RDS database

Answer

Enable sticky sessions (session affinity) on the ALB

Question 8

A company is building a microservices architecture on Amazon ECS. Services need to communicate with each other and with external SaaS applications. The architect must ensure that service discovery is dynamic and that traffic to external services is routed through a single egress point for security and monitoring. Which combination of services should the architect use?

Accepted Answer

AWS Cloud Map for service discovery and a NAT gateway for egress. AWS Cloud Map provides service discovery for microservices, and a NAT gateway provides a consistent egress point. Option B (ALB) is for ingress, not egress. Option C (Route 53) is for DNS resolution but not for egress. Option D (VPC endpoints) is for private connectivity to AWS services, not external SaaS.

Answer

Amazon Route 53 for service discovery and an Application Load Balancer for egress

Answer

AWS Cloud Map for service discovery and an Internet Gateway for egress

Answer

Amazon Route 53 for service discovery and VPC endpoints for egress

Question 9

A financial services company needs to store transaction records for 7 years to meet regulatory requirements. The records must be retrievable within 24 hours of a request. The volume of data is 10 TB per year. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the lowest-cost storage for long-term archival with retrieval times of 12-48 hours, meeting the 24-hour requirement. Option A (S3 Standard) is more expensive. Option B (S3 Glacier) is more expensive than Deep Archive. Option C (S3 Intelligent-Tiering) is designed for changing access patterns, not long-term archive.

Answer

Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Glacier with expedited retrieval

Answer

Amazon S3 Standard with lifecycle policies to transition to S3 Glacier after 1 year

Question 10

A company is deploying a containerized application on Amazon EKS. The application needs to access an Amazon RDS database. The security team requires that database credentials be rotated automatically and never stored in plaintext. Which solution should the architect use?

Accepted Answer

Use AWS Secrets Manager to store and rotate credentials, and grant the EKS pod access via an IAM role. AWS Secrets Manager can rotate RDS credentials automatically and provide them to applications via IAM roles. Option A (Parameter Store) does not support automatic rotation. Option B (environment variables) exposes credentials in plaintext. Option D (IAM database authentication) avoids passwords but does not rotate credentials; it uses tokens.

Answer

Use IAM database authentication for RDS and assign an IAM role to the pod

Answer

Hardcode the credentials in the container image and rotate the image regularly

Answer

Store credentials in AWS Systems Manager Parameter Store and grant the EKS pod access via an IAM role

Question 11

A company runs a critical workload on EC2 instances in an Auto Scaling group. The application is stateless and can handle instance failures. The architect needs to ensure that the application remains available during a regional outage. What is the MOST cost-effective and resilient architecture?

Accepted Answer

Use an active-passive configuration with Auto Scaling groups in two Regions and Route 53 failover. A multi-Region active-passive architecture with Route 53 failover and a warm standby in the secondary region provides resilience at reasonable cost. Option A (multi-AZ within one region) does not protect against regional failure. Option C (active-active across regions) is more expensive. Option D (single Region with spread) still vulnerable to regional failure.

Answer

Deploy the Auto Scaling group in a single Region with instances spread across two AZs

Answer

Deploy the Auto Scaling group in three Availability Zones within a single Region

Answer

Use an active-active configuration across two Regions with Route 53 weighted routing

Question 12

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

Accepted Answer

Configure S3 to send event notifications to the Lambda function directly. S3 can send events directly to Lambda via an S3 event notification. Option A (SNS) adds unnecessary intermediate service. Option B (CloudWatch Events) is not designed for S3 object creation triggers. Option D (SQS) adds latency and complexity.

Answer

Configure S3 to send event notifications to an SNS topic, which triggers the Lambda function

Answer

Configure S3 to send event notifications to an SQS queue, and have the Lambda function poll the queue

Answer

Configure S3 to send event notifications to Amazon CloudWatch Events, which triggers the Lambda function

Question 13

A company has a multi-account AWS organization. The security team wants to centrally manage and enforce that all S3 buckets are encrypted with a specific KMS key. Which approach should the architect recommend?

Accepted Answer

Use a service control policy (SCP) to deny s3:PutBucketEncryption if the encryption is not the specified KMS key. Using SCPs in AWS Organizations allows the security team to deny creation of buckets that do not use the required KMS key. Option A (IAM policies) must be attached to each user/role, not centralized. Option C (Config rules) only detects non-compliance, does not enforce. Option D (Trusted Advisor) provides recommendations only.

Answer

Use AWS Trusted Advisor to check bucket encryption

Answer

Create an IAM policy that denies s3:PutObject unless the request includes the specific KMS key, and attach it to all users

Answer

Use AWS Config rules to detect non-compliant buckets and send alerts

Question 14

A company is designing a disaster recovery strategy for a production database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 1 hour. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Deploy Multi-AZ RDS instance and enable automatic failover. Multi-AZ with automatic failover provides RTO of minutes and RPO of seconds, meeting requirements. Cross-Region read replica with promotion provides RPO of seconds and RTO of minutes (promotion time). Option C (manual snapshot) has RPO > 1 hour and RTO > 15 minutes. Option D (export to S3) has high RTO. Option E (single instance backup) has high RTO.

Answer

Export the database to Amazon S3 using AWS DMS and import in another Region

Answer

Use automated backups with point-in-time recovery in the same Region

Answer

Take manual snapshots every hour and restore in another Region

Question 15

A company is deploying a web application on AWS. The application runs on EC2 instances behind an ALB. The security team requires that all traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Which THREE steps should the architect take? (Choose three.)

Accepted Answer

Configure the ALB target group to use HTTPS protocol. Option A ensures encryption between ALB and instances. Option B restricts instance security group to only ALB's security group. Option D enables HTTPS listener on ALB for client-to-ALB encryption (though question asks for ALB-to-instance, but this is also needed for end-to-end encryption). Option C (public subnets) is not needed. Option E (NACL) is not the best way. Option F (same security group) is not the approach.

Answer

Assign the same security group to the ALB and the instances

Answer

Place the EC2 instances in a public subnet

Answer

Use network ACLs to restrict inbound traffic to the ALB's IP addresses