SAP-C02 Design for New Solutions Practice Test 24 — 15 Questions

Question 1

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an Auto Scaling group with a minimum of two instances across two Availability Zones. An Auto Scaling group with a minimum of two instances across two Availability Zones ensures that if one instance or an entire AZ fails, the remaining instance continues to serve traffic, and Auto Scaling automatically launches a replacement instance to restore the desired count. This architecture provides both high availability and automatic recovery from instance failures without manual intervention.

Answer

Use a single EC2 instance in one AZ and a standby instance in another AZ

Answer

Use AWS Elastic Beanstalk with a single instance environment

Answer

Use AWS CloudFormation to launch a single instance in each AZ

Question 2

A company is designing a new serverless application that uses Amazon API Gateway and AWS Lambda. The application must authenticate users using a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The company wants to offload authentication to the API Gateway. Which solution should the architect recommend?

Accepted Answer

Use an API Gateway COGNITO_USER_POOLS authorizer with Cognito configured as an OIDC client to the third-party IdP. It uses Amazon Cognito as an OIDC client to the third-party IdP, allowing API Gateway's COGNITO_USER_POOLS authorizer to validate tokens from the IdP without custom code. This offloads authentication entirely to API Gateway, as the authorizer checks the JWT token against the Cognito user pool, which trusts the IdP's OIDC tokens. The architecture meets the requirement of using a third-party IdP while keeping the serverless application simple and managed.

Answer

Use an API Gateway COGNITO_USER_POOLS authorizer

Answer

Use an API Gateway Lambda authorizer

Answer

Use an API Gateway IAM authorizer

Question 3

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use client-side encryption with an AWS KMS managed key. Client-side encryption with an AWS KMS managed key allows the application to encrypt data before uploading to S3, providing full control over key usage and an audit trail via AWS CloudTrail for every KMS API call (e.g., Encrypt, Decrypt). Option E is correct because SSE-KMS uses AWS KMS to manage the encryption keys, automatically rotates them annually (when using a KMS key with automatic rotation enabled), and logs all key usage in CloudTrail, meeting the audit trail requirement.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Answer

Use client-side encryption with a master key stored in AWS Secrets Manager

Question 4

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Auto Scaling for write capacity. DynamoDB Auto Scaling adjusts the provisioned write capacity based on actual traffic, preventing throttling during write spikes while reducing capacity and cost during low-traffic periods. This meets the requirement to minimize costs and avoid write throttling without manual intervention.

Answer

Use DynamoDB Streams to asynchronously replicate data to a second table for reads

Answer

Use strongly consistent reads for all queries

Question 5

A company is designing a new web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be highly available across multiple Availability Zones. The company wants to ensure that if an EC2 instance fails, the load balancer stops sending traffic to it. Which two steps should the architect take? (Choose TWO.)

Accepted Answer

Configure a health check on the ALB for the target group. Configuring a health check on the ALB for the target group allows the load balancer to periodically send health check requests to each registered EC2 instance. If an instance fails to respond with a healthy status (e.g., HTTP 200) within the configured interval and threshold, the ALB automatically deregisters it and stops routing traffic to it, ensuring high availability and fault tolerance.

Answer

Use a Network Load Balancer instead of an ALB

Answer

Use an Application Load Balancer with a single target group

Answer

Launch all EC2 instances in a single Availability Zone

Question 6

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

Accepted Answer

Configure the CloudWatch Logs agent on each instance to stream logs to CloudWatch Logs.. The CloudWatch Logs agent streams log data to Amazon CloudWatch Logs in real-time, decoupling log retention from the EC2 instance lifecycle. When instances are terminated, the logs are already persisted in CloudWatch Logs, ensuring they are retained regardless of scaling events.

Answer

Store logs on an EBS volume and take regular snapshots.

Answer

Write logs to the instance store volume of each EC2 instance.

Answer

Write logs to an Amazon S3 bucket mounted on each instance using NFS.

Question 7

A company wants to decouple a microservices architecture where one service (producer) sends events to another service (consumer). The producer can generate bursts of events, and the consumer processes them in batches. The solution must be serverless and handle potential consumer failures without losing events. Which AWS service should be used as the message broker?

Accepted Answer

Amazon SQS. Amazon SQS is a serverless message queue that can buffer bursts and retain messages until the consumer processes them, with dead-letter queues for failures. Option A is wrong because Amazon SNS pushes messages to subscribers and does not support polling or batch processing. Option B is wrong because Kinesis Data Streams is for real-time streaming, not simple decoupling with batch processing. Option C is wrong because EventBridge is for event routing, not a message queue.

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Answer

Amazon EventBridge

Question 8

A company is designing a disaster recovery solution for a critical application that runs on EC2 instances in a single AWS Region. The application uses a custom AMI that is updated weekly. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 4 hours. The solution must minimize cost while meeting these objectives. Which approach should be used?

Accepted Answer

Use EC2 Image Builder to create an updated AMI weekly and replicate it to another Region, then launch instances from the replicated AMI in the DR Region.. EC2 Image Builder automates weekly AMI creation and replication to another Region, ensuring a recent AMI is available for quick instance launch (meeting the 4-hour RTO). For the 15-minute RPO, the DR strategy relies on complementary data replication mechanisms (e.g., database or storage replication) which are more cost-effective than full server replication. Option A is the most efficient approach for the AMI component, while Options C and B are either unnecessarily costly or misaligned, and Option D is manual and error-prone.

Answer

Use Amazon S3 cross-region replication to copy the application data to a bucket in another Region.

Answer

Use AWS CloudEndure Disaster Recovery for continuous replication of the entire server.

Answer

Manually create an AMI of the instance every week and copy it to another region using the AWS Management Console.

Question 9

A company is designing a serverless data processing pipeline. An AWS Lambda function processes records from an Amazon Kinesis Data Stream. The function runs for an average of 30 seconds per record, and the stream has 10 shards. The company expects a sustained load of 5,000 records per second. What is the primary consideration to ensure the Lambda function can scale to handle the load?

Accepted Answer

Ensure that the Lambda function processes each batch within the Kinesis stream's iterator age.. The primary consideration is to ensure that the Lambda function processes each batch within the Kinesis stream's iterator age (default 7 days). With 5,000 records/sec across 10 shards, each shard receives 500 records/sec. If each record takes 30 seconds to process, the Lambda function must process records faster than they arrive to avoid falling behind and exceeding the iterator age, which would cause data loss. The iterator age metric tracks how far behind the consumer is, and if it grows unbounded, records will expire before being processed.

Answer

Request a service quota increase for Lambda concurrent executions.

Answer

Set a reserved concurrency of 500 for the Lambda function.

Answer

Increase the Lambda function timeout to more than 30 seconds.

Question 10

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable encryption at rest for the RDS instance, and enforce SSL/TLS connections by setting the rds.force_ssl parameter to 1.. It uses AWS KMS to encrypt the RDS for PostgreSQL instance at rest and enforces encryption in transit by setting the `rds.force_ssl` parameter to 1, which requires all connections to use SSL/TLS. This satisfies both encryption requirements while leveraging RDS automated backups (retention up to 35 days) at no additional cost beyond standard backup storage, making it the most secure and cost-effective configuration.

Answer

Enable RDS encryption at rest using AWS KMS, and use client-side encryption for data in transit.

Answer

Use an AWS KMS key to encrypt the RDS instance, and configure the DB instance to use SSL/TLS for connections.

Answer

Store the data in Amazon S3 with server-side encryption, and use an RDS database for metadata only.

Question 11

A company is designing a global application that requires a highly available and low-latency API. The API will be consumed by clients across the world. The backend consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances in a single AWS Region. The company wants to improve performance for global users. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Create an AWS Global Accelerator accelerator with the ALB as an endpoint.. AWS Global Accelerator uses the AWS global network to route user traffic to the optimal endpoint, reducing latency and improving availability. By using the ALB as an endpoint, it provides static anycast IP addresses and automatically reroutes traffic if the ALB becomes unhealthy, all with minimal operational overhead since it requires no changes to the application or additional infrastructure.

Answer

Deploy the application in multiple Regions and use Amazon Route 53 latency-based routing with active-passive failover.

Answer

Create an Amazon CloudFront distribution with Lambda@Edge to proxy requests to the ALB.

Answer

Create an Amazon CloudFront distribution with the ALB as the origin.

Question 12

A company is designing a new serverless application using AWS Lambda. The Lambda function needs to access an Amazon RDS database. The database is in a VPC without public internet access. What is the MOST secure way to allow the Lambda function to connect to the database?

Accepted Answer

Configure the Lambda function to access the VPC, and place it in the same subnets as the RDS instance.. Placing the Lambda function in the same VPC subnets as the RDS instance allows it to communicate directly over private IP addresses using the VPC's internal routing. This eliminates exposure to the public internet and leverages security groups to control traffic at the instance level. Lambda functions must be configured with VPC access to connect to resources inside a VPC, and placing them in the same subnets ensures minimal latency and maximum security.

Answer

Create a VPC endpoint for Amazon RDS and use it from Lambda.

Answer

Use an AWS Network Load Balancer in front of the RDS instance and connect Lambda to the NLB.

Answer

Create a public endpoint for the RDS instance and allow Lambda to connect over the internet.

Question 13

A company is designing a data lake on Amazon S3. The data will be ingested from various sources, including streaming data from IoT devices. The data must be processed in near real-time to derive insights. The company wants to use serverless technologies to minimize operational overhead. Which combination of services should the company use?

Accepted Answer

Amazon Kinesis Data Streams, Amazon Kinesis Data Analytics, and Amazon Kinesis Data Firehose.. Amazon Kinesis Data Streams ingests and stores streaming IoT data durably, Amazon Kinesis Data Analytics performs near real-time processing using SQL or Apache Flink, and Amazon Kinesis Data Firehose delivers the processed data to Amazon S3 for the data lake. This combination is fully serverless, scales automatically, and meets the near real-time requirement without managing any infrastructure.

Answer

AWS Lambda, Amazon DynamoDB Streams, and Amazon S3.

Answer

Amazon SQS, AWS Lambda, and Amazon S3.

Answer

Amazon Kinesis Data Firehose, AWS Glue, and Amazon S3.

Question 14

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides an in-memory data store with sub-millisecond latency, which is ideal for storing session state that must be shared across multiple ECS Fargate tasks. Redis supports data structures like hashes and strings that map directly to session data, and it offers built-in replication and automatic failover for high availability. This makes it a purpose-built solution for distributed session management in containerized applications.

Answer

Amazon EFS

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Question 15

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects stored in the bucket are encrypted at rest automatically, even if the upload request does not include encryption headers. Option E is correct because configuring the S3 Block Public Access settings to block all public access prevents any public access to the bucket and its objects, meeting the requirement to block all public access.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use Amazon CloudFront to serve the images and enforce HTTPS.

Answer

Create a bucket policy that denies uploads without encryption in transit.