SAP-C02 Design for New Solutions Practice Test 23 — 15 Questions

Question 1

A company is designing a new application that will use AWS Lambda functions to process events from an Amazon SQS queue. The queue receives messages at a variable rate, with occasional bursts. The Lambda functions must process messages in order and ensure that no message is processed more than once. The company wants to minimize latency and cost. Which solution should a solutions architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Amazon SQS FIFO queue with a message group ID. Configure the Lambda function to use the message group ID as the batch key, and set the batch size to 1.. To ensure ordered processing and exactly-once handling with minimal latency, use an SQS FIFO queue with message group IDs. Lambda can process messages in parallel across different message groups while maintaining order within each group. A batch size of 1 ensures that each invocation handles one message, preventing out-of-order processing due to batch retries.

Answer

Use an Amazon SQS FIFO queue and configure the Lambda function with a batch size of 1. Set the function's reserved concurrency to 1 to ensure ordered processing.

Answer

Use an Amazon SQS FIFO queue and configure the Lambda function with a batch size greater than 1. Enable content-based deduplication on the queue.

Answer

Use an Amazon SQS standard queue and configure the Lambda function with a batch size of 1. Set the function's reserved concurrency to 1 to ensure ordered processing.

Question 2

A company is designing a new application that will use AWS Lambda functions to process events from an Amazon SQS queue. The queue receives messages at a variable rate, with occasional bursts. The Lambda functions must process messages in order and ensure that no message is processed more than once. The company wants to minimize latency and cost. Which solution should a solutions architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Aurora global database with the primary Region in the main Region and a secondary Region. Configure the application to read from the secondary Region's reader endpoint.. Aurora global databases are designed for cross-Region replication with low lag and fast promotion. They allow read-only access from secondary Regions and provide a recovery point objective (RPO) of typically under one second. This makes them ideal for multi-Region applications requiring read scalability and disaster recovery with minimal data loss.

Answer

Set up Aurora MySQL with a cross-Region read replica in the secondary Region. Configure the application to read from the replica.

Answer

Create an Aurora MySQL cluster in the primary Region and use AWS Database Migration Service (DMS) to continuously replicate to a secondary Region. Configure the application to read from the secondary Region.

Answer

Use Amazon RDS for MySQL with a cross-Region read replica. Configure the application to read from the replica in the secondary Region.

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to implement a blue/green deployment strategy with minimal impact on users. Which approach should they use?

Accepted Answer

Create a new target group with the green instances. Modify the ALB listener rule to forward traffic to the new target group.. Blue/green deployment with an ALB is achieved by creating a new target group for the green instances and modifying the ALB listener rule to forward traffic to the new target group. This allows instant traffic shifting with zero downtime, as the ALB can route traffic between target groups without changing the DNS or creating a new ALB. The blue (old) target group remains available for instant rollback if needed.

Answer

Stop all instances, launch new instances with the new version, and update the target group.

Answer

Update the existing target group's instances to the new version, one at a time.

Answer

Create a new ALB and update DNS to point to the new ALB.

Question 4

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application has variable traffic patterns, with high traffic during business hours and low traffic at night. They want to optimize costs while maintaining performance. Which scaling strategy should they implement?

Accepted Answer

Use target tracking scaling with a schedule to increase minimum capacity during business hours.. Combining target tracking scaling with a scheduled action allows the application to dynamically adjust capacity based on actual demand while ensuring a higher baseline during peak business hours. This hybrid approach optimizes costs by scaling down at night and maintains performance by preventing cold starts or lag during traffic spikes, which is ideal for variable patterns on ECS Fargate.

Answer

Use step scaling policies based on memory utilization.

Answer

Use scheduled scaling to increase capacity during business hours.

Answer

Use simple scaling policies based on CPU utilization.

Question 5

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Accepted Answer

TLS for all data in transit. Transport Layer Security encrypts data moving between clients and servers, protecting sensitive financial data from interception or tampering over the network. Option D (AWS Key Management Service (KMS) for encryption at rest) is correct because KMS lets the company create and manage customer master keys used to encrypt stored data, such as EBS volumes, S3 objects, and RDS databases, satisfying the encryption-at-rest requirement. Option B is not correct because AWS Certificate Manager only provisions, manages, and deploys TLS/SSL certificates; it does not itself perform encryption of data at rest or in transit. Option C is not correct because SSL is a deprecated predecessor to TLS, and simply having certificates does not guarantee encryption is enforced on all connections. Option E is not correct because IAM controls authentication and authorization to AWS resources; it does not encrypt data.

Answer

AWS Certificate Manager (ACM) for all encryption

Answer

SSL certificates for all connections

Answer

AWS Identity and Access Management (IAM) for data encryption

Question 6

A company is designing a new application on AWS that requires a relational database with read replicas across multiple AWS Regions. The database must have automated failover and a recovery point objective (RPO) of less than 5 seconds. Which database solution should the company choose?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is designed for cross-Region replication with a typical RPO of less than 1 second and automated failover from the primary Region to a secondary Region in under 1 minute. This meets the requirement for a relational database with read replicas across multiple Regions and an RPO of less than 5 seconds, as Aurora Global Database uses a dedicated, fast replication channel that minimizes lag.

Answer

Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas

Answer

Amazon RDS for PostgreSQL with cross-Region read replicas and Multi-AZ

Answer

Amazon DynamoDB Global Tables

Question 7

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager. Option B is correct because IAM roles for service accounts (IRSA) associates a Kubernetes service account with an IAM role via the cluster's OIDC provider, giving pods scoped, credential-free access to AWS Secrets Manager without embedding long-lived keys. Option C is correct because AWS Secrets Manager natively supports automatic rotation through Lambda rotation functions, and it logs API calls to CloudTrail for auditing, satisfying both the rotation and audit requirements. Option D is correct because the AWS Secrets and Configuration Provider (ASCP) for the Secrets Store CSI Driver mounts Secrets Manager secrets as volumes into pods and can sync them to Kubernetes Secrets, enabling rotation-aware secret delivery to the application. Option A is wrong because the Secrets Store CSI Driver alone cannot retrieve AWS Secrets Manager secrets without the ASCP provider plugin, so mounting the volume directly would fail. Option E is wrong because Kubernetes Secrets are not automatically rotated and are only base64-encoded by default, and ConfigMaps are not designed for sensitive credential storage or auditing.

Answer

Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

Answer

Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

Question 8

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

Accepted Answer

Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.. It combines API Gateway as a managed entry point, Lambda for stateless compute, SQS for decoupling and buffering sudden traffic spikes, DynamoDB for serverless NoSQL storage, and CloudWatch for observability. This serverless stack ensures each microservice is independently deployable and scales automatically without provisioning, handling unpredictable spikes via SQS queue depth and Lambda concurrency limits.

Answer

Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS, and Amazon RDS.

Answer

Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams, and Amazon DynamoDB.

Answer

Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS, and Amazon RDS with read replicas.

Question 9

A company is designing a new microservices architecture on AWS. They need a solution for service discovery that allows services to register themselves and discover other services dynamically. The solution must be highly available and integrated with AWS-native services. Which AWS service should they use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it is a fully managed service discovery service that allows microservices to register themselves dynamically and discover other services via DNS or HTTP API calls. It integrates natively with AWS services like Amazon ECS, Amazon EKS, and AWS Lambda, and provides high availability through automatic health checking and resource synchronization across AWS Regions.

Answer

Amazon ECS Service Discovery

Answer

Application Load Balancer (ALB)

Answer

Amazon Route 53 private hosted zones

Question 10

Drag and drop the steps to migrate an on-premises MySQL database to Amazon RDS using AWS DMS in the correct order.

Accepted Answer

Create replication instance, then create source and target endpoints, then create migration task, then start migration task, then cut over after validation. First create the replication instance, then endpoints, then the migration task, start it, and finally cut over.

Answer

Create replication instance, then create migration task, then create source and target endpoints, then start migration task, then cut over after validation

Answer

Create replication instance, then create source and target endpoints, then cut over after validation, then create migration task, then start migration task

Answer

Create replication instance, then create source and target endpoints, then start migration task, then create migration task, then cut over after validation

Question 11

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

Accepted Answer

Initiate VPC peering connection request, Accept VPC peering connection request, Add routes to route tables, Update security groups, Update network ACLs. First initiate, then accept, then add routes, then update security groups, and finally network ACLs.

Answer

Accept VPC peering connection request, Initiate VPC peering connection request, Add routes to route tables, Update security groups, Update network ACLs

Answer

Initiate VPC peering connection request, Accept VPC peering connection request, Update security groups, Add routes to route tables, Update network ACLs

Answer

Initiate VPC peering connection request, Accept VPC peering connection request, Update network ACLs, Update security groups, Add routes to route tables

Question 12

Drag and drop the steps to recover an Amazon RDS Multi-AZ DB instance after a primary instance failure in the correct order.

Accepted Answer

1) Detect failure, 2) Wait for automatic failover to complete, 3) Verify that the standby instance is promoted to primary, 4) Update application endpoints to point to the new primary, 5) Investigate the root cause of the failure.. First identify failure, wait for failover, verify promotion, update endpoints, then investigate.

Answer

1) Detect failure, 2) Immediately update application endpoints, 3) Verify promotion, 4) Wait for failover to complete, 5) Investigate the cause.

Answer

1) Investigate the root cause of the failure, 2) Detect failure, 3) Wait for automatic failover, 4) Verify promotion, 5) Update endpoints.

Answer

1) Detect failure, 2) Verify promotion, 3) Update endpoints, 4) Wait for failover, 5) Investigate.

Question 13

Match each AWS cost management tool to its use.

Accepted Answer

AWS Cost Explorer: A visual tool that enables you to view and analyze your AWS costs and usage.. Correct matches: Cost Explorer visualizes costs, Budgets set alerts, Trusted Advisor recommends optimizations, and CUR provides detailed data. Common confusions involve mixing tool capabilities.

Answer

AWS Cost Explorer: A service that automatically reduces costs by applying savings plans.

Answer

AWS Budgets: A report that includes all cost and usage data in CSV format.

Question 14

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without direct coupling. Which AWS service should they use to decouple the services?

Accepted Answer

Amazon SQS. Amazon SQS is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, allowing them to send, store, and receive messages without direct coupling. Services can poll or receive messages from the queue at their own pace, ensuring that the producer and consumer are decoupled and can operate independently, even if one is temporarily unavailable.

Answer

AWS Step Functions

Answer

Amazon SNS

Answer

Amazon Kinesis

Question 15

A company is designing a multi-tier web application on AWS. They want to ensure that the web tier can scale automatically based on CPU utilization. Which AWS service should they use?

Accepted Answer

Auto Scaling groups. Auto Scaling groups (Option C) are the correct service because they directly manage the automatic scaling of EC2 instances based on defined policies, such as a target CPU utilization threshold. When CPU utilization exceeds the threshold, the Auto Scaling group launches new instances to handle the load, and it terminates instances when utilization drops, ensuring the web tier scales automatically.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

Elastic Load Balancing