SAP-C02 Design for New Solutions Practice Test 23 — 15 Questions

Question 1

A company is building a data lake on Amazon S3. The data comes from various sources and must be encrypted at rest. The security policy requires that the encryption keys be managed by the company and rotated annually. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C). SSE-C allows the company to manage keys and rotate them. SSE-KMS with customer managed key also allows management and rotation. Option B (SSE-S3) uses AWS-managed keys. Option C (client-side encryption) is not at rest encryption. Option D (default encryption) might use SSE-S3 or SSE-KMS but not necessarily customer managed.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Enable default encryption on the S3 bucket with SSE-S3

Answer

Use client-side encryption with the Amazon S3 encryption client

Question 2

A company is designing a new application that will process messages from an SQS queue. The messages must be processed in real-time with minimal latency, and the processing time per message varies from 100 ms to 5 seconds. The company wants to minimize cost and operational overhead. Which solution should the architect recommend?

Accepted Answer

Use an SQS queue as an event source for an AWS Lambda function. Option A is correct because SQS combined with Lambda provides a serverless solution that scales automatically, processes messages in near real-time, and charges only for compute time used. Option B is wrong because EC2 instances require provisioning and management, leading to higher operational overhead. Option C is wrong because Kinesis is designed for streaming data, not simple message processing. Option D is wrong because SNS is for pub/sub messaging, not for processing messages.

Answer

Use Amazon Kinesis Data Streams and an AWS Lambda function

Answer

Use an SQS queue and an EC2 Auto Scaling group to poll and process messages

Answer

Use SQS to send messages to Amazon SNS, which triggers a Lambda function

Question 3

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

Accepted Answer

Use the default last writer wins conflict resolution. Option D is correct because DynamoDB global tables use last writer wins (LWW) based on a timestamp attribute to resolve concurrent updates. Option A is wrong because conditional writes would reject one update, not guarantee the most recent. Option B is wrong because DynamoDB Streams only capture changes, they do not resolve conflicts. Option C is wrong because optimistic locking requires application logic and does not automatically resolve multi-region conflicts.

Answer

Use optimistic locking with a version number

Answer

Use DynamoDB Streams to capture changes and reconcile conflicts

Answer

Use conditional writes to prevent overwrites

Question 4

A company is designing a new web application that will serve static content (HTML, CSS, JS, images) to users globally. The application must have low latency and high availability. Content changes infrequently, but when updated, the changes must be reflected immediately. Which solution should the architect recommend?

Accepted Answer

Store content in an S3 bucket and use Amazon CloudFront with S3 as origin. Option B is correct because CloudFront can serve static content from an S3 bucket with low latency, and invalidations can be used to immediately update content. Option A is wrong because S3 alone does not provide global low latency. Option C is wrong because CloudFront with an ALB adds unnecessary complexity and cost for static content. Option D is wrong because ElastiCache is not designed for serving static files.

Answer

Store content on an EC2 instance behind an Application Load Balancer and use CloudFront

Answer

Store content in Amazon ElastiCache for Redis and use CloudFront

Answer

Store content in an S3 bucket and use S3 Transfer Acceleration

Question 5

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

Accepted Answer

Store data in S3 with lifecycle policies to transition between storage classes, and use Amazon Athena for queries. Option C is correct because S3 with lifecycle policies can move data to lower-cost storage classes as it ages, and Athena can query data in place without loading. Option A is wrong because Redshift is designed for structured data warehouse workloads, not a data lake. Option B is wrong because S3 with Glacier does not support direct querying; data must be restored first. Option D is wrong because EMR requires managing clusters and is not cost-effective for occasional queries.

Answer

Store data in S3 with lifecycle policies to transition to Glacier, and use S3 Select for queries

Answer

Store data in Amazon EMR on EC2 and query with Hive

Answer

Store data in Amazon Redshift and query with Redshift Spectrum

Question 6

A company is designing a new microservices architecture on AWS. Each microservice is deployed as a containerized application and must be able to scale independently. The company wants to minimize operational overhead for managing the containers and the underlying infrastructure. Which solution should the architect recommend?

Accepted Answer

Amazon ECS with Fargate launch type. Option D is correct because AWS Fargate is a serverless compute engine for containers that eliminates the need to manage underlying instances. Option A is wrong because ECS with EC2 requires managing EC2 instances. Option B is wrong because EKS with managed node groups still requires managing node groups. Option C is wrong because Lightsail is for simple applications, not microservices.

Answer

Amazon EKS with managed node groups

Answer

Amazon ECS with EC2 launch type and Auto Scaling groups

Answer

Amazon Lightsail containers

Question 7

A company is designing a new application that requires a relational database. The application has variable traffic, with high spikes during business hours and low traffic at night. The company wants to minimize costs while ensuring the database can handle the spikes. Which solution should the architect recommend?

Accepted Answer

Use Amazon RDS with Multi-AZ and read replicas, or Amazon Aurora Serverless. Option B is correct because RDS with Multi-AZ and read replicas provides high availability and read scaling, while Aurora Serverless automatically scales compute capacity. Option A is wrong because a single RDS instance is not highly available. Option C is wrong because DynamoDB is NoSQL, not relational. Option D is wrong because RDS with a Single-AZ instance is not highly available and does not handle spikes.

Answer

Use Amazon RDS with a Single-AZ instance and automatic scaling

Answer

Use Amazon DynamoDB with on-demand capacity

Answer

Use Amazon RDS with a Single-AZ instance and a large instance size

Question 8

A company is designing a new system that will ingest and process real-time streaming data from thousands of IoT devices. Each device sends data every second. The data must be processed with low latency (under 1 second) and then stored in Amazon S3 for long-term analytics. The company also needs to be able to reprocess data in case of processing errors. Which solution should the architect recommend?

Accepted Answer

Use Amazon Kinesis Data Streams to ingest data, AWS Lambda to process, and store in S3. Option D is correct because Kinesis Data Streams ingests data with low latency, Lambda processes it, and S3 stores it. Kinesis Data Analytics can also be used for real-time analytics. The stream's data retention allows reprocessing. Option A is wrong because Kinesis Firehose is for near-real-time, not sub-second. Option B is wrong because SQS is not designed for streaming data and does not support reprocessing with the same ease. Option C is wrong because DMS is for database migration, not streaming ingestion.

Answer

Use Amazon Kinesis Data Firehose to ingest data, transform with Lambda, and store in S3

Answer

Use AWS Database Migration Service (DMS) to ingest data into Amazon S3

Answer

Use Amazon SQS to buffer data, and an EC2 Auto Scaling group to process and store in S3

Question 9

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

Accepted Answer

Use an Auto Scaling group with a minimum of two instances across two Availability Zones. Option C is correct because an Auto Scaling group with a minimum of two instances across multiple AZs ensures high availability and automatic recovery. Option A is wrong because a single instance with a standby instance is not automatic. Option B is wrong because Elastic Beanstalk with a single instance is not highly available. Option D is wrong because CloudFormation does not manage recovery.

Answer

Use a single EC2 instance in one AZ and a standby instance in another AZ

Answer

Use AWS Elastic Beanstalk with a single instance environment

Answer

Use AWS CloudFormation to launch a single instance in each AZ

Question 10

A company is designing a new serverless application that uses Amazon API Gateway and AWS Lambda. The application must authenticate users using a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The company wants to offload authentication to the API Gateway. Which solution should the architect recommend?

Accepted Answer

Use an API Gateway COGNITO_USER_POOLS authorizer with Cognito configured as an OIDC client to the third-party IdP. Option D is correct because API Gateway can use a COGNITO_USER_POOLS authorizer with an OIDC identity provider for authentication. Option A is wrong because COGNITO_USER_POOLS supports OIDC, but Cognito must be configured as an OIDC client. Option B is wrong because Lambda authorizers are custom, not offloading authentication. Option C is wrong because IAM authorization is for AWS credentials, not OIDC.

Answer

Use an API Gateway COGNITO_USER_POOLS authorizer

Answer

Use an API Gateway Lambda authorizer

Answer

Use an API Gateway IAM authorizer

Question 11

A company is designing a new application that will store sensitive customer data in Amazon S3. The data must be encrypted at rest. The company wants to use an encryption solution that provides an audit trail of when keys are used and by whom. The company also wants to rotate the encryption keys automatically every year. Which two options meet these requirements? (Choose TWO.)

Accepted Answer

Use client-side encryption with an AWS KMS managed key. Options B and C are correct. SSE-KMS uses AWS KMS which provides audit trail via CloudTrail and automatic key rotation. SSE-C does not provide key rotation. Client-side encryption with KMS also provides audit trail and rotation. Option A (SSE-S3) does not provide audit trail. Option D (SSE-C) does not provide rotation. Option E (client-side with master key) does not provide rotation or audit trail.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Answer

Use client-side encryption with a master key stored in AWS Secrets Manager

Question 12

A company is designing a new application that will use Amazon DynamoDB as its database. The application will have a heavy read workload with occasional write spikes. The company wants to minimize costs while ensuring that reads are eventually consistent and writes are not throttled. Which three options should the architect consider? (Choose THREE.)

Accepted Answer

Use Auto Scaling for write capacity. Options A, B, and D are correct. DynamoDB Accelerator (DAX) provides a cache for reads, reducing read capacity units. Read capacity can be set to eventually consistent reads (lower cost). Auto Scaling adjusts write capacity to handle spikes. Option C is wrong because strongly consistent reads cost more. Option E is wrong because DynamoDB Streams are for change capture, not for read performance.

Answer

Use DynamoDB Streams to asynchronously replicate data to a second table for reads

Answer

Use strongly consistent reads for all queries

Question 13

A company is designing a new web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be highly available across multiple Availability Zones. The company wants to ensure that if an EC2 instance fails, the load balancer stops sending traffic to it. Which two steps should the architect take? (Choose TWO.)

Accepted Answer

Configure a health check on the ALB for the target group. Options A and D are correct. Configuring a health check on the ALB ensures the load balancer can detect unhealthy instances and stop sending traffic. Using an Auto Scaling group with a minimum of two instances across multiple AZs ensures high availability and replacement of failed instances. Option B is wrong because using only one AZ does not provide multi-AZ high availability. Option C is wrong because a Network Load Balancer is for TCP traffic, not HTTP. Option E is wrong because an ALB is needed for HTTP traffic.

Answer

Use a Network Load Balancer instead of an ALB

Answer

Use an Application Load Balancer with a single target group

Answer

Launch all EC2 instances in a single Availability Zone

Question 14

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

Accepted Answer

Configure the CloudWatch Logs agent on each instance to stream logs to CloudWatch Logs.. Option C is correct because CloudWatch Logs agent can stream logs to CloudWatch Logs, which persists logs independently of instance lifecycle. Option A is wrong because instance store data is ephemeral. Option B is wrong because S3 mounted via NFS is complex and not designed for real-time log streaming. Option D is wrong because EBS snapshots are not for continuous log collection.

Answer

Store logs on an EBS volume and take regular snapshots.

Answer

Write logs to the instance store volume of each EC2 instance.

Answer

Write logs to an Amazon S3 bucket mounted on each instance using NFS.

Question 15

A company wants to decouple a microservices architecture where one service (producer) sends events to another service (consumer). The producer can generate bursts of events, and the consumer processes them in batches. The solution must be serverless and handle potential consumer failures without losing events. Which AWS service should be used as the message broker?

Accepted Answer

Amazon SQS. Option A is correct because Amazon SQS is a serverless message queue that can buffer bursts and retain messages until the consumer processes them, with dead-letter queues for failures. Option B is wrong because Amazon SNS pushes messages to subscribers and does not support polling or batch processing. Option C is wrong because Kinesis Data Streams is for real-time streaming, not simple decoupling with batch processing. Option D is wrong because EventBridge is for event routing, not a message queue.

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Answer

Amazon EventBridge