SAP-C02 Design for New Solutions Practice Test 25 — 15 Questions

Question 1

A company is designing a new microservices architecture using Amazon ECS with the Fargate launch type. The services need to communicate securely within a VPC. The company requires that inter-service communication is encrypted and that the services can discover each other using DNS names. Which THREE steps should the company take to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS Cloud Map for service discovery.. AWS Cloud Map is a cloud resource discovery service that allows microservices to dynamically discover each other using DNS names or API calls. By integrating Cloud Map with ECS service discovery, tasks can register themselves with a namespace, enabling other services to resolve their IP addresses via DNS queries, which satisfies the requirement for DNS-based discovery.

Answer

Deploy an Application Load Balancer in front of each service for inter-service communication.

Answer

Create a VPC peering connection between the services' subnets.

Question 2

A company is designing a new application that will run on Amazon EC2 instances. The application writes logs to local disk, and the logs must be aggregated centrally for analysis. The company wants a solution that requires minimal configuration and can handle high log volume. Which TWO AWS services should the company use?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (option D) can collect logs from EC2 instances via the CloudWatch agent with minimal configuration and at scale. Amazon CloudWatch Logs Insights (option E) provides a query engine to interactively search and analyze the aggregated logs. Option A (Amazon S3) is used for log storage, not for real-time collection or analysis. Option B (AWS Lambda) can process logs but is not designed for high-volume log ingestion without additional setup. Option C (Amazon Kinesis Data Firehose) is for streaming data to destinations like S3 or Redshift, but it requires more configuration and is not the simplest solution for EC2 log collection.

Answer

Amazon S3

Answer

AWS Lambda

Answer

Amazon Kinesis Data Firehose

Question 3

A company is designing a multi-region disaster recovery solution for a stateless web application running on Amazon ECS Fargate. The application uses an Application Load Balancer and stores session data in Amazon ElastiCache for Redis. The company needs to achieve an RPO of 15 minutes and an RTO of 30 minutes. What is the MOST cost-effective design that meets these requirements?

Accepted Answer

Deploy a second ECS cluster and ALB in the secondary region with a scaled-down number of tasks. Use ElastiCache Global Datastore for Redis to replicate session data. Use Route 53 health checks to fail over.. It uses ElastiCache Global Datastore for Redis, which provides cross-Region replication with sub-minute RPO, meeting the 15-minute RPO requirement. The scaled-down ECS tasks in the secondary region can be quickly scaled up to achieve the 30-minute RTO, and Route 53 health checks enable automated failover. This design minimizes cost by running only minimal capacity in the secondary region until failover occurs.

Answer

Deploy a second ECS cluster and ALB in the secondary region with no tasks. Use cross-Region replication for ElastiCache. Use Route 53 to fail over after scaling up tasks.

Answer

Use a multi-region ECS service with Service Connect and Route 53 latency-based routing. Keep equal capacity in both regions.

Answer

Use pilot light by replicating ECS task definitions and copying AMIs to the secondary region. Use ElastiCache snapshot and restore. Fail over with Route 53.

Question 4

A company is designing a serverless data processing pipeline that uses AWS Lambda to process messages from Amazon SQS. Each message requires 5 minutes of processing time. The company expects a steady state of 1,000 messages per second. What is the MOST scalable and cost-effective design?

Accepted Answer

Deploy an Amazon ECS service with Fargate that polls the SQS queue. Use an SQS queue with long polling and auto scaling based on queue depth.. Amazon ECS with Fargate provides a fully managed, serverless compute environment that can handle long-running tasks (5 minutes per message) without the 15-minute Lambda timeout limit. By using long polling and auto scaling based on queue depth, the solution scales cost-effectively to process 1,000 messages per second, as Fargate tasks can run indefinitely and scale horizontally to match the workload.

Answer

Use an SQS queue and a Lambda function that processes messages in batches. Set the Lambda function timeout to 15 minutes and use reserved concurrency.

Answer

Use an Amazon MQ broker with ActiveMQ and configure a Lambda function to consume messages from a queue.

Answer

Configure an SQS queue with a Lambda trigger. Set the Lambda function timeout to 5 minutes and the batch size to 1.

Question 5

A company wants to store application logs in Amazon S3 with a lifecycle policy that moves objects to S3 Glacier Instant Retrieval after 30 days and deletes them after 1 year. The logs are accessed frequently in the first 30 days but rarely after. Which storage class should the company use for the first 30 days?

Accepted Answer

S3 Standard. S3 Standard is the correct choice because the logs are accessed frequently during the first 30 days. Standard provides low-latency access with no retrieval fees, and the lifecycle policy can transition objects to S3 Glacier Instant Retrieval after 30 days. For data that is accessed multiple times within a short retention period, Standard is more cost-effective than Standard-IA, which incurs retrieval fees and a 30-day minimum storage charge.

Answer

S3 Standard-IA

Answer

S3 One Zone-IA

Answer

S3 Glacier Flexible Retrieval

Question 6

A company is designing a highly available application on AWS that uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application requires that the client's IP address be preserved in the application logs. The company also needs to perform SSL termination at the load balancer. How should the company configure the ALB to meet these requirements?

Accepted Answer

Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 80. Enable X-Forwarded-For header.. Using an HTTPS listener on port 443 with SSL termination at the ALB allows the load balancer to decrypt traffic and forward it as HTTP on port 80. The X-Forwarded-For header is automatically added by the ALB to preserve the original client IP address in the application logs, meeting both requirements without additional configuration.

Answer

Use TCP listener on port 443 and forward to instances on port 80. Enable proxy protocol v2.

Answer

Use TCP listener on port 443 and forward to instances on port 443. Install SSL certificate on instances.

Answer

Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 443. Disable proxy protocol.

Question 7

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. Each device sends a JSON payload every second. The company needs to store the raw data for a month and then aggregate it into hourly summaries for long-term storage. The solution must be serverless and cost-effective. Which combination of AWS services should the company use?

Accepted Answer

Amazon Kinesis Data Streams to ingest data, Amazon Kinesis Data Analytics to aggregate in real-time, Amazon Kinesis Data Firehose to deliver aggregated data to S3, and an S3 Lifecycle policy to expire raw data after 30 days.. Kinesis Data Streams ingests real-time data, Kinesis Data Analytics performs real-time aggregation, and Kinesis Data Firehose delivers aggregated data to S3. An S3 Lifecycle policy can expire raw data after 30 days. Option A uses Lambda for aggregation, which is not ideal for streaming aggregations. Option C misses the real-time aggregation step. Option D uses SQS, which is not designed for real-time streaming, and DynamoDB is not suitable for raw data storage at high volumes.

Answer

Amazon Kinesis Data Streams to ingest data, AWS Lambda to transform and aggregate, Amazon S3 for storage.

Answer

Amazon Kinesis Data Streams to ingest data, Amazon Kinesis Data Firehose to deliver to S3, and Amazon Athena to query raw data.

Answer

Amazon SQS to ingest data, AWS Lambda to process and aggregate, Amazon DynamoDB for raw data, S3 for summaries.

Question 8

A company is designing a microservices architecture using Amazon ECS with Fargate. Each microservice needs to communicate with others via REST APIs. The company wants to ensure that communication is encrypted in transit and that services can discover each other using DNS names. Which set of actions should the company take?

Accepted Answer

Enable ECS Service Connect on each service, and use the service discovery names provided by Service Connect.. ECS Service Connect provides built-in DNS-based service discovery and automatic encryption via TLS for inter-service communication. Option B uses AWS Cloud Map for service discovery but does not enforce encryption in transit. Option C uses a Network Load Balancer (NLB) in front of each service, which adds unnecessary complexity and cost without addressing service discovery. Option D uses an Application Load Balancer (ALB) in front of each service, which is also overly complex and costly for simple inter-service communication.

Answer

Create a namespace in AWS Cloud Map, register each service, and configure service-to-service communication using the namespace.

Answer

Place a Network Load Balancer in front of each service and use the NLB DNS name for communication.

Answer

Place an Application Load Balancer in front of each service and use the ALB DNS name for communication.

Question 9

A company is designing a cost-effective solution to store and serve large media files (e.g., videos) to users globally. The files are frequently accessed initially but become rarely accessed after 30 days. The company needs millisecond retrieval for the first 30 days and can tolerate retrieval times of minutes after that. What storage solution should the company use?

Accepted Answer

Amazon S3 Standard-IA for first 30 days, then transition to S3 Glacier Flexible Retrieval.. S3 Standard-IA is cost-effective for infrequent access but still provides millisecond retrieval for the first 30 days, and transition to Glacier after 30 days. Option A is too expensive. Option C provides millisecond retrieval but is expensive. Option D is for archival only.

Answer

Amazon S3 Standard for all files, with lifecycle policy to delete after 30 days.

Answer

Amazon S3 Intelligent-Tiering with automatic tiering.

Answer

Amazon S3 Glacier Instant Retrieval for all files.

Question 10

A company is designing a serverless application that uses AWS Lambda to process events from Amazon DynamoDB Streams. The Lambda function updates an Amazon RDS for MySQL database. The company expects a high volume of updates and is concerned about the Lambda function causing too many connections to the database. How should the company design the solution to manage the database connection pool effectively?

Accepted Answer

Use Amazon RDS Proxy to pool database connections, and configure the Lambda function to connect through the proxy.. Amazon RDS Proxy sits between the Lambda function and the RDS database, maintaining a pool of established connections. When Lambda invocations scale up, they reuse connections from the pool instead of opening new ones, preventing the database from being overwhelmed. This is the recommended AWS pattern for serverless applications with high concurrency and relational databases.

Answer

Increase the Lambda function timeout and use a single database connection per function instance.

Answer

Use a singleton Lambda function with a reserved concurrency of 1 to ensure only one connection is used.

Answer

Use a Lambda function that batches records from DynamoDB Streams and uses a single database connection per batch.

Question 11

A company is designing a new application that requires a relational database. The application has variable workloads with predictable spikes. The company wants to minimize costs while ensuring that the database can handle the spikes. Which Amazon RDS feature should the company use?

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it acts as a connection pooling layer that efficiently manages database connections, allowing the application to handle variable workloads and predictable spikes without overwhelming the database. It reduces the overhead of connection management and improves scalability. RDS Storage Auto Scaling only scales storage capacity, not compute or connection handling, and thus does not address workload spikes. Read Replicas are useful for offloading read traffic but do not provide automatic scaling for unpredictable spikes. Multi-AZ deployment ensures high availability and failover but does not scale the database for variable workloads.

Answer

RDS Storage Auto Scaling

Answer

Read Replicas

Answer

Multi-AZ deployment

Question 12

A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable default encryption with SSE-KMS on the S3 bucket.. Options A and E are correct. A: Enabling default encryption with SSE-KMS ensures data is encrypted at rest using AWS Key Management Service, providing control over encryption keys. E: A bucket policy that allows access only from specific IAM roles ensures only authorized users can access the data, following the principle of least privilege. Option B (client-side encryption) is not required as server-side encryption meets the requirement. Option C (server access logging) does not control access or encryption. Option D (bucket ACL) is less secure and not recommended for controlling access compared to IAM policies.

Answer

Use client-side encryption before uploading to S3.

Answer

Enable S3 server access logging.

Answer

Use a bucket ACL to grant access to the data lake.

Question 13

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and efficiently. The company wants to implement service-to-service authentication and authorization. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Use AWS Secrets Manager to store and rotate service credentials.. AWS Secrets Manager provides a secure way to store and automatically rotate service credentials (such as database passwords or API keys) used by microservices running on ECS Fargate. This eliminates hard-coded secrets and reduces the risk of credential exposure, aligning with security best practices for service-to-service authentication.

Answer

Configure mutual TLS (mTLS) between services using certificates from ACM.

Answer

Deploy an API Gateway in front of each microservice.

Question 14

A company is designing a disaster recovery solution for an Amazon Aurora MySQL database. The database is currently in a single AWS Region. The company needs an RPO of less than 1 minute and an RTO of less than 5 minutes. Which TWO steps should the company take? (Choose TWO.)

Accepted Answer

Configure an Aurora Global Database with a secondary cluster in another Region.. Options A and C are correct. A: An Aurora Global Database with a secondary cluster in another Region provides replication with sub-minute RPO. C: Amazon RDS Proxy helps reduce failover time by managing database connections and routing traffic to the new primary during a failover, thus improving RTO. Option B is incorrect because cross-Region read replicas in Aurora typically have higher replication lag, which does not meet the sub-minute RPO requirement; Aurora Global Database is the appropriate approach. Option D is incorrect because Aurora Serverless auto scaling does not address cross-Region disaster recovery. Option E is incorrect because Multi-AZ provides high availability within a single Region, but does not meet the cross-Region DR requirement with sub-minute RPO and sub-5-minute RTO.

Answer

Create a read replica in another Region.

Answer

Enable Aurora Serverless auto scaling.

Answer

Enable Multi-AZ for the Aurora cluster.

Question 15

A company is designing a new microservices architecture on AWS. Each service must be independently deployable and scale based on demand. The company wants to minimize operational overhead for container orchestration. Which AWS service should the company use?

Accepted Answer

Amazon Elastic Container Service (ECS) with AWS Fargate. Amazon ECS with AWS Fargate is the correct choice because it provides a fully managed container orchestration service that eliminates the need to provision, configure, or scale underlying EC2 instances. Fargate runs each container in its own isolated compute environment, allowing each microservice to scale independently based on demand while minimizing operational overhead for cluster management.

Answer

Amazon Elastic Kubernetes Service (EKS)

Answer

Amazon EC2 with Auto Scaling

Answer

AWS Lambda