SAP-C02 Design for New Solutions Practice Test 23 — 15 Questions

Question 1

A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires that users' session data be stored and made available across all instances. Which solution is MOST cost-effective and scalable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon ElastiCache for Redis to store session data. Amazon ElastiCache for Redis provides a fully managed, in-memory data store that is ideal for storing session state externally from the EC2 instances. This decouples session data from the compute layer, allowing any instance to retrieve the same session data regardless of which instance originally handled the request. Redis offers sub-millisecond latency, built-in replication, and automatic failover, making it both highly scalable and cost-effective for session management at scale.

Answer

Store session data on an Amazon EBS volume attached to each instance

Answer

Store session data in an Amazon RDS database

Answer

Enable sticky sessions (session affinity) on the ALB

Question 2

A company is building a microservices architecture on Amazon ECS. Services need to communicate with each other and with external SaaS applications. The architect must ensure that service discovery is dynamic and that traffic to external services is routed through a single egress point for security and monitoring. Which combination of services should the architect use?

Accepted Answer

AWS Cloud Map for service discovery and a NAT gateway for egress. AWS Cloud Map is the correct choice for dynamic service discovery in Amazon ECS because it allows services to register themselves with a logical service name and be discovered via DNS or API calls, which is ideal for microservices that scale and change frequently. A NAT gateway provides a single, controlled egress point for outbound traffic to external SaaS applications, enabling centralized security monitoring and consistent IP address management, unlike an Internet Gateway which would expose instances directly.

Answer

Amazon Route 53 for service discovery and an Application Load Balancer for egress

Answer

AWS Cloud Map for service discovery and an Internet Gateway for egress

Answer

Amazon Route 53 for service discovery and VPC endpoints for egress

Question 3

A financial services company needs to store transaction records for 7 years to meet regulatory requirements. The records must be retrievable within 24 hours of a request. The volume of data is 10 TB per year. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the most cost-effective storage class for data that must be retained for 7 years and retrieved within 24 hours, as it offers the lowest storage cost among AWS storage options while supporting retrieval times of 12–24 hours via standard retrieval. The 10 TB/year volume (70 TB total) and 24-hour retrieval window align perfectly with Glacier Deep Archive's design for long-term archival data that is rarely accessed.

Answer

Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Glacier with expedited retrieval

Answer

Amazon S3 Standard with lifecycle policies to transition to S3 Glacier after 1 year

Question 4

A company is deploying a containerized application on Amazon EKS. The application needs to access an Amazon RDS database. The security team requires that database credentials be rotated automatically and never stored in plaintext. Which solution should the architect use?

Accepted Answer

Use AWS Secrets Manager to store and rotate credentials, and grant the EKS pod access via an IAM role. AWS Secrets Manager is the correct choice because it natively supports automatic rotation of RDS database credentials via a built-in Lambda rotation function, and it integrates with IAM roles to grant EKS pods secure access without storing secrets in plaintext. By using an IAM role for the pod (via IRSA), the application can retrieve credentials at runtime from Secrets Manager, ensuring compliance with the security team's requirements.

Answer

Use IAM database authentication for RDS and assign an IAM role to the pod

Answer

Hardcode the credentials in the container image and rotate the image regularly

Answer

Store credentials in AWS Systems Manager Parameter Store and grant the EKS pod access via an IAM role

Question 5

A company runs a critical workload on EC2 instances in an Auto Scaling group. The application is stateless and can handle instance failures. The architect needs to ensure that the application remains available during a regional outage. What is the MOST cost-effective and resilient architecture?

Accepted Answer

Use an active-passive configuration with Auto Scaling groups in two Regions and Route 53 failover. It provides multi-Region resilience using an active-passive architecture, which is the most cost-effective approach for a stateless application that must survive a regional outage. The active-passive setup uses Route 53 failover routing to direct traffic to the primary Region under normal conditions and automatically fail over to the secondary Region only when the primary is unhealthy, minimizing ongoing costs by keeping the secondary infrastructure idle or minimal until needed.

Answer

Deploy the Auto Scaling group in a single Region with instances spread across two AZs

Answer

Deploy the Auto Scaling group in three Availability Zones within a single Region

Answer

Use an active-active configuration across two Regions with Route 53 weighted routing

Question 6

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

Accepted Answer

Configure S3 to send event notifications to the Lambda function directly. Amazon S3 can directly invoke an AWS Lambda function via event notifications when a new object is created. This is the simplest and most direct integration, requiring no intermediate services. S3 publishes an event to Lambda, which then executes the function synchronously, ensuring near-real-time processing of uploaded files.

Answer

Configure S3 to send event notifications to an SNS topic, which triggers the Lambda function

Answer

Configure S3 to send event notifications to an SQS queue, and have the Lambda function poll the queue

Answer

Configure S3 to send event notifications to Amazon CloudWatch Events, which triggers the Lambda function

Question 7

A company has a multi-account AWS organization. The security team wants to centrally manage and enforce that all S3 buckets are encrypted with a specific KMS key. Which approach should the architect recommend?

Accepted Answer

Use a service control policy (SCP) to deny s3:PutBucketEncryption if the encryption is not the specified KMS key. A service control policy (SCP) can deny the s3:PutBucketEncryption action unless the encryption setting specifies the required KMS key. This centrally enforces the encryption requirement across all accounts in the AWS Organization, preventing any account from creating or modifying a bucket with non-compliant encryption, regardless of IAM permissions within that account.

Answer

Use AWS Trusted Advisor to check bucket encryption

Answer

Create an IAM policy that denies s3:PutObject unless the request includes the specific KMS key, and attach it to all users

Answer

Use AWS Config rules to detect non-compliant buckets and send alerts

Question 8

A company is designing a disaster recovery strategy for a production database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 1 hour. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Deploy Multi-AZ RDS instance and enable automatic failover. Multi-AZ RDS for MySQL provides automatic synchronous standby replication to a different Availability Zone, enabling automatic failover within minutes (typically 1-2 minutes) without data loss. This meets the 15-minute RTO and 1-hour RPO, as failover is automated and synchronous replication ensures zero data loss.

Answer

Export the database to Amazon S3 using AWS DMS and import in another Region

Answer

Use automated backups with point-in-time recovery in the same Region

Answer

Take manual snapshots every hour and restore in another Region

Question 9

A company is designing a new application that will process messages from an SQS queue. The messages must be processed in real-time with minimal latency, and the processing time per message varies from 100 ms to 5 seconds. The company wants to minimize cost and operational overhead. Which solution should the architect recommend?

Accepted Answer

Use an SQS queue as an event source for an AWS Lambda function. Using an SQS queue as an event source for AWS Lambda enables real-time, low-latency processing of messages without any polling infrastructure to manage. Lambda automatically scales to handle variable processing times (100 ms to 5 seconds) and charges only for compute time used, minimizing both cost and operational overhead. This serverless approach eliminates the need for EC2 instances or Auto Scaling groups, aligning perfectly with the requirements for minimal latency and reduced management effort.

Answer

Use Amazon Kinesis Data Streams and an AWS Lambda function

Answer

Use an SQS queue and an EC2 Auto Scaling group to poll and process messages

Answer

Use SQS to send messages to Amazon SNS, which triggers a Lambda function

Question 10

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

Accepted Answer

Use the default last writer wins conflict resolution. Amazon DynamoDB global tables use a last writer wins (LWW) conflict resolution mechanism based on the timestamp of the update. When concurrent updates to the same item occur in different regions, DynamoDB automatically compares the update timestamps and retains the most recently written data. This satisfies the requirement to use the most recently written data without requiring custom reconciliation logic.

Answer

Use optimistic locking with a version number

Answer

Use DynamoDB Streams to capture changes and reconcile conflicts

Answer

Use conditional writes to prevent overwrites

Question 11

A company is designing a new web application that will serve static content (HTML, CSS, JS, images) to users globally. The application must have low latency and high availability. Content changes infrequently, but when updated, the changes must be reflected immediately. Which solution should the architect recommend?

Accepted Answer

Store content in an S3 bucket and use Amazon CloudFront with S3 as origin. Amazon CloudFront, with an S3 bucket as the origin, provides a global content delivery network (CDN) that caches static content at edge locations, significantly reducing latency for users worldwide. S3 offers durable, highly available storage, and CloudFront’s cache invalidation or versioned object updates allow changes to be reflected immediately when content is updated. This combination meets the requirements for low latency, high availability, and immediate content refresh.

Answer

Store content on an EC2 instance behind an Application Load Balancer and use CloudFront

Answer

Store content in Amazon ElastiCache for Redis and use CloudFront

Answer

Store content in an S3 bucket and use S3 Transfer Acceleration

Question 12

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

Accepted Answer

Store data in S3 with lifecycle policies to transition between storage classes, and use Amazon Athena for queries. Amazon S3 lifecycle policies allow automatic transition of objects between storage classes (e.g., S3 Standard to S3 Standard-IA to S3 Glacier Deep Archive) based on age, optimizing cost for varying access patterns. Amazon Athena enables serverless SQL querying directly on data stored in S3, making it ideal for a petabyte-scale data lake without managing infrastructure.

Answer

Store data in S3 with lifecycle policies to transition to Glacier, and use S3 Select for queries

Answer

Store data in Amazon EMR on EC2 and query with Hive

Answer

Store data in Amazon Redshift and query with Redshift Spectrum

Question 13

A company is designing a new microservices architecture on AWS. Each microservice is deployed as a containerized application and must be able to scale independently. The company wants to minimize operational overhead for managing the containers and the underlying infrastructure. Which solution should the architect recommend?

Accepted Answer

Amazon ECS with Fargate launch type. Amazon ECS with the Fargate launch type is the correct choice because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. This directly meets the requirement to minimize operational overhead while allowing each microservice to scale independently, as Fargate automatically handles the infrastructure and scaling based on the task definitions.

Answer

Amazon EKS with managed node groups

Answer

Amazon ECS with EC2 launch type and Auto Scaling groups

Answer

Amazon Lightsail containers

Question 14

A company is designing a new application that requires a relational database. The application has variable traffic, with high spikes during business hours and low traffic at night. The company wants to minimize costs while ensuring the database can handle the spikes. Which solution should the architect recommend?

Accepted Answer

Use Amazon RDS with Multi-AZ and read replicas, or Amazon Aurora Serverless. Amazon Aurora Serverless automatically scales compute capacity based on application demand, making it ideal for variable traffic with high spikes during business hours and low traffic at night, while minimizing costs by only paying for consumed resources. Multi-AZ RDS with read replicas provides high availability and read scaling but does not automatically scale compute for write spikes, so Aurora Serverless is the more cost-effective and fully managed solution for this use case.

Answer

Use Amazon RDS with a Single-AZ instance and automatic scaling

Answer

Use Amazon DynamoDB with on-demand capacity

Answer

Use Amazon RDS with a Single-AZ instance and a large instance size

Question 15

A company is designing a new system that will ingest and process real-time streaming data from thousands of IoT devices. Each device sends data every second. The data must be processed with low latency (under 1 second) and then stored in Amazon S3 for long-term analytics. The company also needs to be able to reprocess data in case of processing errors. Which solution should the architect recommend?

Accepted Answer

Use Amazon Kinesis Data Streams to ingest data, AWS Lambda to process, and store in S3. Amazon Kinesis Data Streams provides sub-second ingestion latency, which meets the under-1-second processing requirement. AWS Lambda can process each record with low latency and store the results directly in Amazon S3. Kinesis Data Streams also supports data replay for up to 365 days (default 24 hours), enabling reprocessing in case of errors.

Answer

Use Amazon Kinesis Data Firehose to ingest data, transform with Lambda, and store in S3

Answer

Use AWS Database Migration Service (DMS) to ingest data into Amazon S3

Answer

Use Amazon SQS to buffer data, and an EC2 Auto Scaling group to process and store in S3