SAP-C02 Design for New Solutions Practice Test 24 — 15 Questions

Question 1

A company needs to provide a global content delivery solution with low latency. Which AWS service should they use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a global content delivery network (CDN) that caches content at edge locations worldwide, reducing latency by serving data from the nearest edge to the user. It integrates with origins like S3, EC2, or on-premises servers and supports both static and dynamic content acceleration, making it the correct choice for low-latency global delivery.

Answer

Amazon S3

Answer

Amazon EC2

Answer

Amazon Route 53

Question 2

A company is designing a data lake on AWS using Amazon S3. They need to run SQL queries on the data without moving it to a separate database. Which AWS service should they use?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless, interactive query service that allows you to run standard SQL queries directly against data stored in Amazon S3 without needing to move or transform the data. It uses Presto under the hood and charges only for the data scanned per query, making it ideal for ad-hoc SQL analysis on a data lake.

Answer

Amazon EMR

Answer

Amazon Redshift

Answer

AWS Glue

Question 3

A company is designing a disaster recovery solution for a critical database using Amazon RDS Multi-AZ. However, they also need to protect against regional failures. Which additional AWS service should they use?

Accepted Answer

RDS Cross-Region Read Replicas. RDS Multi-AZ provides high availability within a single region by synchronously replicating data to a standby instance in a different Availability Zone. To protect against a regional failure, you need a cross-region disaster recovery solution. RDS Cross-Region Read Replicas asynchronously replicate data to a different AWS Region, allowing you to promote the replica to a standalone primary database in the event of a regional outage.

Answer

RDS Multi-AZ in the same region

Answer

Amazon S3

Answer

AWS Database Migration Service

Question 4

A company wants to implement a serverless architecture where an AWS Lambda function is triggered whenever a new object is uploaded to an S3 bucket. Which S3 feature should they use?

Accepted Answer

S3 Event Notifications. S3 Event Notifications allow you to configure S3 to publish events (e.g., s3:ObjectCreated:Put) to AWS Lambda, SQS, or SNS whenever an object is uploaded. This is the native serverless integration that triggers a Lambda function directly from S3 without polling or custom code.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Question 5

A company is designing a new application on AWS that requires a highly available and fault-tolerant architecture. Which TWO design principles should they follow?

Accepted Answer

Use Auto Scaling groups to automatically replace unhealthy instances.. Option A is correct because Auto Scaling groups continuously perform health checks and automatically terminate and replace unhealthy EC2 instances, which maintains capacity and self-heals the fleet without manual intervention, directly supporting fault tolerance. Option B is correct because deploying the application across multiple Availability Zones isolates it from a single-AZ failure; each AZ has independent power, cooling, and networking, so the workload remains available if one AZ goes down. Option C is not a high-availability design principle: manual daily EBS snapshots are a backup/recovery mechanism with a recovery point objective of up to 24 hours, not automatic failover. Option D does not belong because a single S3 bucket in one Region concentrates data in one geographic location and does not by itself provide cross-Region fault tolerance (though S3 is internally redundant within a Region). Option E is wrong because a single large EC2 instance is a single point of failure and cannot deliver high availability or fault tolerance.

Answer

Manually create EBS snapshots every day.

Answer

Store data in a single Amazon S3 bucket in one Region.

Answer

Use a single large EC2 instance to simplify management.

Question 6

A company is building a serverless application using AWS Lambda and Amazon API Gateway. They need to authenticate users. Which TWO services can be used for authentication?

Accepted Answer

AWS IAM. Amazon Cognito (D) is correct because it provides user pools that handle sign-up, sign-in, and token issuance (ID, access, and refresh tokens) for API Gateway, and it also supports identity pools for federated identities, making it the standard managed authentication service for serverless applications. AWS IAM (B) is correct because API Gateway can use IAM authorization (SigV4-signed requests) to authenticate and authorize callers, and Lambda execution roles and resource policies rely on IAM for identity and access control. AWS Security Token Service (A) is not a standalone authentication service; it issues temporary credentials after authentication has already occurred, so it is not the answer here. Amazon SQS (C) is a message queuing service and Amazon CloudFront (E) is a content delivery network, neither of which authenticates users.

Answer

AWS Security Token Service

Answer

Amazon SQS

Answer

Amazon CloudFront

Question 7

A company is designing a new microservices-based application on AWS. They want to ensure that services can discover each other dynamically and that traffic can be load balanced across multiple Availability Zones. Which AWS service should they use for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that allows microservices to dynamically register their endpoints (IP addresses, ports) and discover each other via DNS or API calls. It integrates with Amazon Route 53 auto-naming and health checks, enabling load-balanced traffic across multiple Availability Zones by returning healthy, available endpoints. This makes it the correct choice for dynamic service discovery in a microservices architecture.

Answer

AWS Service Catalog

Answer

Amazon Route 53 private hosted zones

Answer

AWS Systems Manager Parameter Store

Question 8

A startup is building a serverless application using AWS Lambda. They need to securely store and retrieve database credentials without hardcoding them in the function code. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and retrieving database credentials and other secrets throughout their lifecycle. It integrates natively with Lambda via the AWS SDK, allowing retrieval of credentials at runtime without hardcoding, and supports automatic rotation of secrets for supported databases like Amazon RDS.

Answer

Amazon DynamoDB

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 9

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to output logs to CloudWatch Logs. Which configuration should be used to send logs from the container to CloudWatch?

Accepted Answer

Use the awslogs log driver in the task definition and specify the log group.. The awslogs log driver is the native, built-in mechanism for Amazon ECS tasks using the Fargate launch type to send container logs directly to CloudWatch Logs. By specifying the 'awslogs' log driver in the task definition and providing the log group name, ECS automatically streams stdout and stderr from the container to the specified CloudWatch log group without requiring any additional agents or infrastructure.

Answer

Install and configure the CloudWatch agent in the container image.

Answer

Output logs to stdout/stderr and use a Lambda function to push them.

Answer

Configure a sidecar container running the CloudWatch agent.

Question 10

A company is building a new web application that will be accessed by users globally. They want to minimize latency and protect against DDoS attacks. Which AWS service should they use as the entry point?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is correct because it is a global content delivery network (CDN) that caches content at edge locations close to users, reducing latency for static and dynamic content. It also provides built-in DDoS protection through AWS Shield Standard and can integrate with AWS WAF for additional layer 7 filtering, making it the ideal entry point for a globally accessed web application requiring both low latency and DDoS mitigation.

Answer

Elastic Load Balancing

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 11

A company is designing a new solution that uses Amazon S3 to store large amounts of archival data. The data must be retained for 7 years and then automatically deleted. Which S3 feature should they use?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies allow you to define rules that automatically expire objects after a specified period, such as 7 years. This directly meets the requirement to retain archival data for a fixed duration and then delete it without manual intervention.

Answer

S3 Replication

Answer

S3 Versioning

Answer

S3 Object Lock

Question 12

A company is migrating a legacy on-premises application to AWS. The application requires a fixed IP address for whitelisting by external partners. The solution must be highly available across multiple Availability Zones. Which design should they use?

Accepted Answer

Use a Network Load Balancer (NLB) with an Elastic IP address.. A Network Load Balancer (NLB) supports static IP addresses via Elastic IPs per Availability Zone, providing a fixed IP for partner whitelisting while maintaining high availability across multiple AZs. Unlike ALBs, NLBs operate at Layer 4 and can preserve the client IP, which is critical for IP-based whitelisting scenarios.

Answer

Use an Application Load Balancer (ALB) with an Elastic IP address.

Answer

Use Amazon Route 53 with a weighted routing policy.

Answer

Use a Classic Load Balancer (CLB) with an Elastic IP address.

Question 13

A company wants to share a large dataset stored in Amazon S3 with a partner who has their own AWS account. The partner needs to access the data using their own account credentials. Which approach should the company use?

Accepted Answer

Grant the partner's AWS account access via a bucket policy.. A bucket policy can grant cross-account access to the partner's AWS account by specifying the partner's AWS account ID as the principal. This allows the partner's IAM users or roles to access the S3 bucket directly using their own credentials, without needing to share access keys or create users in the company's account. The bucket policy must explicitly allow the necessary actions (e.g., s3:GetObject) and the partner must also have an IAM policy that permits the same actions.

Answer

Use S3 cross-region replication.

Answer

Create a pre-signed URL for the partner.

Answer

Provide the partner with an IAM user in the company's account.

Question 14

Which TWO AWS services can be used to decouple components in a new microservices architecture? (Choose two.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SNS (option A) is correct because it is a fully managed pub/sub messaging service that decouples microservices by allowing a publisher to send messages to multiple subscribers via topics, so producers and consumers do not need to know about each other. Amazon SQS (option D) is correct because it is a fully managed message queueing service that decouples components by storing messages in queues, enabling asynchronous communication and absorbing traffic spikes between microservices. AWS Direct Connect (option B) is not correct because it is a dedicated network connection service for hybrid connectivity, not an application decoupling mechanism. Amazon Route 53 (option C) is not correct because it is a DNS and traffic-routing service, not a messaging or queueing service. Amazon ElastiCache (option E) is not correct because it is an in-memory caching service, which improves performance but does not decouple components through asynchronous messaging.

Answer

AWS Direct Connect

Answer

Amazon Route 53

Answer

Amazon ElastiCache

Question 15

A Solutions Architect is reviewing the IAM policy shown in the exhibit. The policy is attached to an IAM user. Which of the following is true about this policy?

Accepted Answer

The policy allows s3:GetObject on example-bucket only from the specified IP range.. The IAM policy uses a `Condition` block with `IpAddress` to restrict the `s3:GetObject` action on `example-bucket` to requests originating from the specified IP range. The `Effect` is `Allow`, so the policy grants the `s3:GetObject` permission only when the source IP matches the condition, effectively limiting access to that range.

Answer

The policy denies access if the source IP is not in the specified range.

Answer

The policy is invalid because the Resource is not specific enough.

Answer

The policy allows all S3 actions on all buckets.