SAP-C02 Design for New Solutions Practice Test 25 — 15 Questions

Question 1

A company is designing a microservices architecture using Amazon ECS with Fargate. Each microservice needs to communicate with others via REST APIs. The company wants to ensure that communication is encrypted in transit and that services can discover each other using DNS names. Which set of actions should the company take?

Accepted Answer

Enable ECS Service Connect on each service, and use the service discovery names provided by Service Connect.. Option A is correct because ECS Service Connect provides DNS-based service discovery and automatic encryption via TLS. Option B uses Cloud Map but does not enforce encryption. Option C uses ALB which adds complexity and cost. Option D uses NLB unnecessarily.

Answer

Create a namespace in AWS Cloud Map, register each service, and configure service-to-service communication using the namespace.

Answer

Place a Network Load Balancer in front of each service and use the NLB DNS name for communication.

Answer

Place an Application Load Balancer in front of each service and use the ALB DNS name for communication.

Question 2

A company is designing a cost-effective solution to store and serve large media files (e.g., videos) to users globally. The files are frequently accessed initially but become rarely accessed after 30 days. The company needs millisecond retrieval for the first 30 days and can tolerate retrieval times of minutes after that. What storage solution should the company use?

Accepted Answer

Amazon S3 Standard-IA for first 30 days, then transition to S3 Glacier Flexible Retrieval.. Option B is correct because S3 Standard-IA is cost-effective for infrequent access but still provides millisecond retrieval for the first 30 days, and transition to Glacier after 30 days. Option A is too expensive. Option C provides millisecond retrieval but is expensive. Option D is for archival only.

Answer

Amazon S3 Standard for all files, with lifecycle policy to delete after 30 days.

Answer

Amazon S3 Intelligent-Tiering with automatic tiering.

Answer

Amazon S3 Glacier Instant Retrieval for all files.

Question 3

A company is designing a serverless application that uses AWS Lambda to process events from Amazon DynamoDB Streams. The Lambda function updates an Amazon RDS for MySQL database. The company expects a high volume of updates and is concerned about the Lambda function causing too many connections to the database. How should the company design the solution to manage the database connection pool effectively?

Accepted Answer

Use Amazon RDS Proxy to pool database connections, and configure the Lambda function to connect through the proxy.. Option D is correct because Lambda functions should not maintain persistent connections across invocations; using RDS Proxy manages connection pooling. Option A is not possible in Lambda. Option B is not recommended because Lambda can scale rapidly. Option C does not solve the connection pooling issue.

Answer

Increase the Lambda function timeout and use a single database connection per function instance.

Answer

Use a singleton Lambda function with a reserved concurrency of 1 to ensure only one connection is used.

Answer

Use a Lambda function that batches records from DynamoDB Streams and uses a single database connection per batch.

Question 4

A company is designing a new application that requires a relational database. The application has variable workloads with predictable spikes. The company wants to minimize costs while ensuring that the database can handle the spikes. Which Amazon RDS feature should the company use?

Accepted Answer

RDS Storage Auto Scaling. Option C is correct because RDS Auto Scaling automatically adjusts storage or compute capacity based on demand. Option A is for disaster recovery. Option B provides high availability but does not handle variable workloads. Option D is for global scaling.

Answer

Read Replicas

Answer

RDS Proxy

Answer

Multi-AZ deployment

Question 5

A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable default encryption with SSE-KMS on the S3 bucket.. Options B and D are correct. B: S3 bucket policy with IAM conditions restricts access. D: SSE-KMS provides encryption with key management. Option A is too broad. Option C does not control access. Option E is not a primary encryption method for at-rest.

Answer

Use client-side encryption before uploading to S3.

Answer

Enable S3 server access logging.

Answer

Use a bucket ACL to grant access to the data lake.

Question 6

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and efficiently. The company wants to implement service-to-service authentication and authorization. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Use AWS Secrets Manager to store and rotate service credentials.. Options A, C, and E are correct. A: ECS Service Connect provides DNS and encryption. C: IAM roles for tasks grant permissions. E: Secrets Manager stores secrets. Option B is not needed with Service Connect. Option D is for public APIs.

Answer

Configure mutual TLS (mTLS) between services using certificates from ACM.

Answer

Deploy an API Gateway in front of each microservice.

Question 7

A company is designing a disaster recovery solution for an Amazon Aurora MySQL database. The database is currently in a single AWS Region. The company needs an RPO of less than 1 minute and an RTO of less than 5 minutes. Which TWO steps should the company take? (Choose TWO.)

Accepted Answer

Configure an Aurora Global Database with a secondary cluster in another Region.. Options A and E are correct. A: Cross-Region Aurora Global Database provides replication with sub-minute RPO. E: RDS Proxy helps with fast failover by managing connections. Option B is for RDS, not Aurora. Option C is for RDS. Option D is for Aurora Serverless, not for global replication.

Answer

Create a read replica in another Region.

Answer

Enable Aurora Serverless auto scaling.

Answer

Enable Multi-AZ for the Aurora cluster.

Question 8

A company is designing a new microservices architecture on AWS. Each service must be independently deployable and scale based on demand. The company wants to minimize operational overhead for container orchestration. Which AWS service should the company use?

Accepted Answer

Amazon Elastic Container Service (ECS) with AWS Fargate. Option D is correct because Amazon ECS with Fargate is a fully managed container orchestration service that reduces operational overhead. Option A is wrong because EC2 requires manual management of instances. Option B is wrong because Lambda is for serverless functions, not container orchestration. Option C is wrong because EKS requires managing the Kubernetes control plane.

Answer

Amazon Elastic Kubernetes Service (EKS)

Answer

Amazon EC2 with Auto Scaling

Answer

AWS Lambda

Question 9

A company is designing a global application that requires low-latency read access to a database from multiple AWS regions. The database stores user profile data that is updated infrequently. The solution must ensure eventual consistency and minimize write conflicts. Which combination of AWS services should be used?

Accepted Answer

Amazon DynamoDB global tables. Option B is correct because DynamoDB global tables provide multi-region replication with eventual consistency and automatic conflict resolution. Option A is wrong because RDS Multi-AZ does not replicate across regions. Option C is wrong because ElastiCache is a cache, not a primary data store. Option D is wrong because Aurora Global Database provides strong consistency, not eventual.

Answer

Amazon RDS Multi-AZ with read replicas in each region

Answer

Amazon Aurora Global Database

Answer

Amazon ElastiCache for Redis with global datastore

Question 10

A company is designing a new application that will process streaming data from IoT devices. The data must be ingested in real-time and stored in Amazon S3 for long-term analytics. Which AWS service should be used to ingest the streaming data?

Accepted Answer

Amazon Kinesis Data Streams. Option C is correct because Amazon Kinesis Data Streams is designed for real-time data ingestion. Option A is wrong because SQS is for message queues, not streaming ingestion. Option B is wrong because SNS is for pub/sub messaging. Option D is wrong because DMS is for database migration.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Database Migration Service (DMS)

Question 11

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle millions of requests per day. To reduce latency and offload traffic from the EC2 instances, which AWS service should be placed in front of the load balancer?

Accepted Answer

Amazon CloudFront. Option A is correct because CloudFront is a CDN that caches content at edge locations, reducing latency and offloading traffic. Option B is wrong because Global Accelerator improves performance via AWS global network but does not cache. Option C is wrong because WAF is a web application firewall. Option D is wrong because Shield is for DDoS protection.

Answer

AWS Global Accelerator

Answer

AWS Shield Advanced

Answer

AWS WAF

Question 12

A company is designing a data lake on AWS using Amazon S3. The data will be ingested from various sources and must be encrypted at rest. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption option should be used?

Accepted Answer

Server-side encryption with S3 managed keys (SSE-S3). Option B is correct because SSE-S3 uses AWS-managed keys that are automatically rotated. Option A is wrong because SSE-C uses customer-provided keys. Option C is wrong because SSE-KMS uses customer-managed KMS keys. Option D is wrong because client-side encryption is managed by the customer.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS)

Answer

Client-side encryption

Question 13

A company is designing a new application that will be deployed on AWS. The application requires a relational database with automatic failover and high availability within a single AWS region. Which database deployment option meets these requirements?

Accepted Answer

Amazon RDS Multi-AZ deployment. Option C is correct because RDS Multi-AZ provides automatic failover and high availability within a region. Option A is wrong because Single-AZ does not provide failover. Option B is wrong because Read Replicas are for read scaling, not failover. Option D is wrong because cross-region replication is for disaster recovery, not primary failover.

Answer

Amazon RDS Single-AZ deployment

Answer

Amazon RDS with Read Replicas

Answer

Amazon RDS cross-region replication

Question 14

A company is designing a serverless application using AWS Lambda. The application needs to store and retrieve JSON documents. The company wants the lowest cost for infrequent access. Which data store should be used?

Accepted Answer

Amazon DynamoDB (on-demand). Option D is correct because Amazon DynamoDB with on-demand capacity is serverless and cost-effective for infrequent access. Option A is wrong because S3 Standard is not ideal for small JSON documents and has higher cost for frequent updates. Option B is wrong because RDS is relational and not serverless. Option C is wrong because ElastiCache is a cache, not a durable store.

Answer

Amazon RDS for MySQL

Answer

Amazon S3 Standard

Answer

Amazon ElastiCache for Redis

Question 15

A company is designing a new solution to process a continuous stream of events from multiple sources. The events must be processed in real-time with exactly-once processing semantics. The solution should be able to handle replayed events without duplication. Which AWS service should be used for the event processing?

Accepted Answer

Amazon Kinesis Data Analytics for Apache Flink. Option A is correct because Amazon Kinesis Data Analytics for Apache Flink provides exactly-once processing semantics. Option B is wrong because Lambda functions are at-least-once. Option C is wrong because Kinesis Data Firehose is for loading data, not processing. Option D is wrong because SQS is at-least-once.

Answer

Amazon Kinesis Data Firehose

Answer

AWS Lambda with Kinesis trigger

Answer

Amazon Simple Queue Service (SQS) with Lambda