SAP-C02 Design for New Solutions Practice Test 24 — 15 Questions

Question 1

A company is designing a disaster recovery solution for a critical application that runs on EC2 instances in a single AWS Region. The application uses a custom AMI that is updated weekly. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 4 hours. The solution must minimize cost while meeting these objectives. Which approach should be used?

Accepted Answer

Use EC2 Image Builder to create an updated AMI weekly and replicate it to another Region, then launch instances from the replicated AMI in the DR Region.. Option D is correct because EC2 Image Builder can automate AMI creation and replication to another region, meeting weekly updates and RPO/RTO with minimal cost. Option A is wrong because CloudEndure continuous replication has higher cost and complexity. Option B is wrong because AMI sharing is manual and does not meet RPO. Option C is wrong because S3 cross-region replication is for objects, not AMIs.

Answer

Use Amazon S3 cross-region replication to copy the application data to a bucket in another Region.

Answer

Use AWS CloudEndure Disaster Recovery for continuous replication of the entire server.

Answer

Manually create an AMI of the instance every week and copy it to another region using the AWS Management Console.

Question 2

A company is designing a serverless data processing pipeline. An AWS Lambda function processes records from an Amazon Kinesis Data Stream. The function runs for an average of 30 seconds per record, and the stream has 10 shards. The company expects a sustained load of 5,000 records per second. What is the primary consideration to ensure the Lambda function can scale to handle the load?

Accepted Answer

Ensure that the Lambda function processes each batch within the Kinesis stream's iterator age.. Option B is correct because each Lambda function instance processes one shard at a time, so the number of concurrent executions equals the number of shards (10). The function must be able to process records within the Kinesis iterator age to avoid throttling. Option A is wrong because Lambda can handle the concurrency; the limit is per shard. Option C is wrong because reserved concurrency could limit scaling. Option D is wrong because Lambda scales within the account limits, but the shard count is the bottleneck.

Answer

Request a service quota increase for Lambda concurrent executions.

Answer

Set a reserved concurrency of 500 for the Lambda function.

Answer

Increase the Lambda function timeout to more than 30 seconds.

Question 3

A company is designing a new application that will store sensitive user data in an Amazon RDS for PostgreSQL database. The data must be encrypted at rest and in transit. The company also requires automated backups with a retention period of 35 days. What is the MOST secure and cost-effective configuration?

Accepted Answer

Enable encryption at rest for the RDS instance, and enforce SSL/TLS connections by setting the rds.force_ssl parameter to 1.. Option C is correct because enabling encryption at rest (via RDS encryption) and in transit (SSL/TLS) meets both requirements; automated backups are included and retained up to 35 days. Option A is wrong because client-side encryption adds unnecessary complexity. Option B is wrong because AWS KMS is part of RDS encryption, not an additional service. Option D is wrong because RDS encryption at rest is sufficient; no need for separate S3 encryption.

Answer

Enable RDS encryption at rest using AWS KMS, and use client-side encryption for data in transit.

Answer

Use an AWS KMS key to encrypt the RDS instance, and configure the DB instance to use SSL/TLS for connections.

Answer

Store the data in Amazon S3 with server-side encryption, and use an RDS database for metadata only.

Question 4

A company is designing a global application that requires a highly available and low-latency API. The API will be consumed by clients across the world. The backend consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances in a single AWS Region. The company wants to improve performance for global users. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Create an AWS Global Accelerator accelerator with the ALB as an endpoint.. Option D is correct because AWS Global Accelerator uses the AWS global network to route traffic to the optimal endpoint, providing low latency and high availability. Option A is wrong because Lambda@Edge is for content transformation, not API proxying. Option B is wrong because CloudFront can cache API responses but is not ideal for dynamic APIs that require low latency; Global Accelerator is better for non-cacheable traffic. Option C is wrong because active-passive setup with Route 53 failover does not optimize latency for global users.

Answer

Deploy the application in multiple Regions and use Amazon Route 53 latency-based routing with active-passive failover.

Answer

Create an Amazon CloudFront distribution with Lambda@Edge to proxy requests to the ALB.

Answer

Create an Amazon CloudFront distribution with the ALB as the origin.

Question 5

A company is designing a new serverless application using AWS Lambda. The Lambda function needs to access an Amazon RDS database. The database is in a VPC without public internet access. What is the MOST secure way to allow the Lambda function to connect to the database?

Accepted Answer

Configure the Lambda function to access the VPC, and place it in the same subnets as the RDS instance.. Option B is correct because configuring the Lambda function to access the VPC allows it to use an ENI to connect to the RDS instance within the VPC. Option A is wrong because the database is not publicly accessible. Option C is wrong because VPC endpoints are for accessing AWS services, not RDS instances. Option D is wrong because Network Load Balancer is not needed for direct database connections.

Answer

Create a VPC endpoint for Amazon RDS and use it from Lambda.

Answer

Use an AWS Network Load Balancer in front of the RDS instance and connect Lambda to the NLB.

Answer

Create a public endpoint for the RDS instance and allow Lambda to connect over the internet.

Question 6

A company is designing a data lake on Amazon S3. The data will be ingested from various sources, including streaming data from IoT devices. The data must be processed in near real-time to derive insights. The company wants to use serverless technologies to minimize operational overhead. Which combination of services should the company use?

Accepted Answer

Amazon Kinesis Data Streams, Amazon Kinesis Data Analytics, and Amazon Kinesis Data Firehose.. Option A is correct because Kinesis Data Streams ingests streaming data, Kinesis Data Analytics performs near real-time analysis, and Kinesis Data Firehose delivers the results to S3. Option B is wrong because SQS is not for streaming data. Option C is wrong because Lambda alone cannot handle streaming data at scale. Option D is wrong because Glue is for batch ETL, not real-time.

Answer

AWS Lambda, Amazon DynamoDB Streams, and Amazon S3.

Answer

Amazon SQS, AWS Lambda, and Amazon S3.

Answer

Amazon Kinesis Data Firehose, AWS Glue, and Amazon S3.

Question 7

A company is designing a new application that will run on Amazon ECS with Fargate launch type. The application needs to store session state that is shared across multiple tasks. The session data must be highly available and low-latency. Which AWS service should be used to store the session state?

Accepted Answer

Amazon ElastiCache for Redis. Option B is correct because Amazon ElastiCache for Redis provides an in-memory data store with low latency and high availability, ideal for session state. Option A is wrong because DynamoDB is a NoSQL database with higher latency than in-memory. Option C is wrong because EFS is a file system, not optimized for session state. Option D is wrong because RDS is a relational database with higher latency.

Answer

Amazon EFS

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Question 8

A company is designing a new application that will use Amazon S3 to store user-uploaded images. The application must enforce that all uploads are encrypted in transit and at rest. Additionally, the bucket must be configured to block all public access. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Option A is correct because enabling S3 default encryption ensures objects are encrypted at rest. Option D is correct because blocking public access via the Block Public Access settings is a bucket-level control. Option B is wrong because bucket policies are not used for encryption. Option C is wrong because CloudFront is not related to S3 encryption. Option E is wrong because SSE-C is client-managed, but the question does not specify client-managed keys.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use Amazon CloudFront to serve the images and enforce HTTPS.

Answer

Create a bucket policy that denies uploads without encryption in transit.

Question 9

A company is designing a new microservices architecture using Amazon ECS with the Fargate launch type. The services need to communicate securely within a VPC. The company requires that inter-service communication is encrypted and that the services can discover each other using DNS names. Which THREE steps should the company take to meet these requirements?

Accepted Answer

Enable AWS Cloud Map for service discovery.. Option A is correct because Service Discovery enables DNS-based service discovery. Option B is correct because ECS tasks can use service discovery names via DNS. Option D is correct because VPC endpoints for ECR and other services are needed for Fargate to pull images. Option C is wrong because VPC Peering is not needed; services are in the same VPC. Option E is wrong because an Application Load Balancer is not required for inter-service communication; service discovery and direct communication suffice.

Answer

Deploy an Application Load Balancer in front of each service for inter-service communication.

Answer

Create a VPC peering connection between the services' subnets.

Question 10

A company is designing a new application that will run on Amazon EC2 instances. The application writes logs to local disk, and the logs must be aggregated centrally for analysis. The company wants a solution that requires minimal configuration and can handle high log volume. Which TWO AWS services should the company use?

Accepted Answer

Amazon CloudWatch Logs. Option A is correct because CloudWatch Logs can collect logs from EC2 instances via the CloudWatch agent. Option C is correct because CloudWatch Logs Insights allows querying and analyzing logs. Option B is wrong because S3 is for log storage, not analysis. Option D is wrong because Kinesis Data Firehose is for streaming data, not for EC2 log collection. Option E is wrong because Lambda is not used for log analysis.

Answer

Amazon S3

Answer

AWS Lambda

Answer

Amazon Kinesis Data Firehose

Question 11

A company is designing a multi-region disaster recovery solution for a stateless web application running on Amazon ECS Fargate. The application uses an Application Load Balancer and stores session data in Amazon ElastiCache for Redis. The company needs to achieve an RPO of 15 minutes and an RTO of 30 minutes. What is the MOST cost-effective design that meets these requirements?

Accepted Answer

Deploy a second ECS cluster and ALB in the secondary region with a scaled-down number of tasks. Use ElastiCache Global Datastore for Redis to replicate session data. Use Route 53 health checks to fail over.. Option A is correct because it meets the RPO and RTO with a warm standby approach that keeps a scaled-down copy running in the secondary region. Option B is too slow for RTO. Option C is too expensive (pilot light doesn't match). Option D is too slow for RTO.

Answer

Deploy a second ECS cluster and ALB in the secondary region with no tasks. Use cross-Region replication for ElastiCache. Use Route 53 to fail over after scaling up tasks.

Answer

Use a multi-region ECS service with Service Connect and Route 53 latency-based routing. Keep equal capacity in both regions.

Answer

Use pilot light by replicating ECS task definitions and copying AMIs to the secondary region. Use ElastiCache snapshot and restore. Fail over with Route 53.

Question 12

A company is designing a serverless data processing pipeline that uses AWS Lambda to process messages from Amazon SQS. Each message requires 5 minutes of processing time. The company expects a steady state of 1,000 messages per second. What is the MOST scalable and cost-effective design?

Accepted Answer

Deploy an Amazon ECS service with Fargate that polls the SQS queue. Use an SQS queue with long polling and auto scaling based on queue depth.. Option B is correct because Lambda has a 15-minute timeout and can scale concurrency, but to handle 1,000 msg/s with 5 min processing, you need enough concurrency. However, Lambda concurrency per account has limits; the better approach is to use a Lambda function that reads from SQS in batches and processes each message, but the function timeout must be at least 5 min per invocation. Option A is wrong because Lambda can't run for 5 minutes (timeout is 15 min, so it's possible, but the question implies 5 min per message, so batch size of 1 is fine). Actually, Lambda max execution is 15 min, so 5 min is fine. The main issue is that Lambda concurrency default is 1,000, and with 1,000 msg/s, each message takes 5 min, you'd need 300,000 concurrent executions, which exceeds default limits. So the best design is to use an Amazon ECS service with auto scaling. Option B is correct.

Answer

Use an SQS queue and a Lambda function that processes messages in batches. Set the Lambda function timeout to 15 minutes and use reserved concurrency.

Answer

Use an Amazon MQ broker with ActiveMQ and configure a Lambda function to consume messages from a queue.

Answer

Configure an SQS queue with a Lambda trigger. Set the Lambda function timeout to 5 minutes and the batch size to 1.

Question 13

A company wants to store application logs in Amazon S3 with a lifecycle policy that moves objects to S3 Glacier Instant Retrieval after 30 days and deletes them after 1 year. The logs are accessed frequently in the first 30 days but rarely after. Which storage class should the company use for the first 30 days?

Accepted Answer

S3 Standard-IA. Option B is correct because S3 Standard-IA is cost-effective for data accessed infrequently but with rapid access when needed, and it transitions to Glacier Instant Retrieval. Option A is too expensive if logs are not frequently accessed. Option C is for infrequent access with longer retrieval times. Option D is for archival.

Answer

S3 Standard

Answer

S3 One Zone-IA

Answer

S3 Glacier Flexible Retrieval

Question 14

A company is designing a highly available application on AWS that uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application requires that the client's IP address be preserved in the application logs. The company also needs to perform SSL termination at the load balancer. How should the company configure the ALB to meet these requirements?

Accepted Answer

Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 80. Enable X-Forwarded-For header.. Option C is correct because ALB with SSL termination and X-Forwarded-For header preserves the client IP. Option A terminates SSL on instances, which adds overhead. Option B is for Network Load Balancer, which does not support HTTP features. Option D is wrong because ALB can be internet-facing.

Answer

Use TCP listener on port 443 and forward to instances on port 80. Enable proxy protocol v2.

Answer

Use TCP listener on port 443 and forward to instances on port 443. Install SSL certificate on instances.

Answer

Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 443. Disable proxy protocol.

Question 15

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. Each device sends a JSON payload every second. The company needs to store the raw data for a month and then aggregate it into hourly summaries for long-term storage. The solution must be serverless and cost-effective. Which combination of AWS services should the company use?

Accepted Answer

Amazon Kinesis Data Streams to ingest data, Amazon Kinesis Data Analytics to aggregate in real-time, Amazon Kinesis Data Firehose to deliver aggregated data to S3, and an S3 Lifecycle policy to expire raw data after 30 days.. Option D is correct because Kinesis Data Streams ingests real-time data, Kinesis Data Analytics performs real-time aggregation, and Firehose delivers to S3. Option A uses Lambda for aggregation, which is not ideal for streaming aggregations. Option B uses SQS, which is not designed for real-time streaming. Option C misses the real-time aggregation step.

Answer

Amazon Kinesis Data Streams to ingest data, AWS Lambda to transform and aggregate, Amazon S3 for storage.

Answer

Amazon Kinesis Data Streams to ingest data, Amazon Kinesis Data Firehose to deliver to S3, and Amazon Athena to query raw data.

Answer

Amazon SQS to ingest data, AWS Lambda to process and aggregate, Amazon DynamoDB for raw data, S3 for summaries.