SAP-C02 Design for New Solutions Practice Test 25 — 15 Questions

Question 1

A company is deploying a containerized microservices architecture on Amazon ECS with Fargate. They need to securely store and rotate database credentials. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing the lifecycle of database credentials. It integrates natively with Amazon ECS and Fargate via task role permissions, allowing containers to retrieve secrets at runtime without hardcoding them. Secrets Manager also supports automatic rotation of credentials for Amazon RDS, Aurora, and other databases, which directly addresses the requirement for credential rotation.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Systems Manager Parameter Store

Question 2

A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?

Accepted Answer

Use Amazon CloudFront with the S3 bucket as the origin.. Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users. Using an S3 bucket as the origin is cost-effective because CloudFront egress costs are often lower than direct S3 data transfer, and you only pay for data transfer out from CloudFront and occasional origin fetches. This solution minimizes origin load and provides low-latency delivery without the overhead of managing servers or additional acceleration services.

Answer

Use AWS Global Accelerator with endpoints pointing to the S3 bucket.

Answer

Deploy EC2 instances in multiple Regions and use a load balancer.

Answer

Host the content directly from the S3 bucket and use S3 Transfer Acceleration.

Question 3

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application experiences sudden traffic spikes. What is the most effective way to ensure the application can handle the spikes without manual intervention?

Accepted Answer

Use a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy based on average CPU utilization is the most effective approach because it automatically adjusts the Auto Scaling group's desired capacity in real-time to maintain a target CPU metric (e.g., 50%). This dynamic scaling method responds directly to sudden traffic spikes without any manual intervention, ensuring the application can handle increased load while optimizing cost.

Answer

Increase the instance size to handle more load per instance.

Answer

Manually increase the desired capacity when traffic spikes.

Answer

Use scheduled scaling to add instances at expected peak times.

Question 4

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. It offers strong read-after-write consistency and low-latency access, making it ideal for shared file workloads requiring POSIX permissions and concurrent access.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon S3

Question 5

A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?

Accepted Answer

Enable EBS encryption on the volumes and configure the application to use TLS for all network traffic.. It addresses both encryption requirements: EBS encryption ensures data at rest is encrypted using AWS KMS-managed keys, and configuring the application to use TLS encrypts data in transit between clients and the EC2 instances. This combination directly meets the stated security needs without relying on external services like S3 or ACM for the EC2-hosted application.

Answer

Use Amazon S3 with server-side encryption and enforce HTTPS.

Answer

Use AWS Key Management Service (KMS) to generate keys and enable encryption on EBS volumes.

Answer

Use AWS Certificate Manager (ACM) to issue TLS certificates and configure the application to use HTTPS.

Question 6

A company is designing a new application that will process streaming data from thousands of IoT devices. The data must be ingested in real time and then processed using Apache Flink. Which services should be used? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams (A) is correct because it provides a highly scalable, real-time ingestion service that can capture data from thousands of IoT devices with low latency, making it ideal for streaming ingestion. Amazon Kinesis Data Analytics for Apache Flink (C) is correct because it is the managed service that runs Apache Flink applications to process and analyze streaming data in real time, directly integrating with Kinesis Data Streams as a source. AWS Lambda (B) is not designed for continuous stream processing with Apache Flink and is better suited for event-driven, short-lived functions. Amazon Kinesis Data Firehose (D) is primarily for loading streaming data into destinations like S3, Redshift, or Elasticsearch, not for running Flink processing. Amazon SQS (E) is a message queue for decoupling components, not a real-time streaming ingestion or Flink processing service.

Answer

AWS Lambda

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Simple Queue Service (SQS)

Question 7

A company runs a high-traffic web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes during peak hours. Analysis shows that the latency spikes correlate with high CPU utilization on the EC2 instances. The company wants to reduce latency without over-provisioning. Which solution is MOST cost-effective and scalable?

Accepted Answer

Configure an Auto Scaling group with a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy based on average CPU utilization automatically adjusts the number of EC2 instances in the Auto Scaling group to maintain a target CPU utilization level. This directly addresses the latency spikes caused by high CPU utilization during peak hours by scaling out horizontally, while scaling in during low traffic to avoid over-provisioning, making it both cost-effective and scalable.

Answer

Add Amazon ElastiCache to cache database queries.

Answer

Use Spot Instances to reduce costs and scale horizontally.

Answer

Increase the EC2 instance size to handle peak loads.

Question 8

A startup is building a serverless application using AWS Lambda for business logic and Amazon DynamoDB for data storage. The application must process a high volume of writes to a single DynamoDB table. The development team is concerned about throttling due to hot partitions. Which design should the team implement to avoid throttling?

Accepted Answer

Use a composite primary key with a partition key that has high cardinality, such as a user ID.. Using a partition key with high cardinality, such as a user ID, ensures that write requests are evenly distributed across all partitions in the DynamoDB table. This prevents any single partition from becoming a hot partition, which would otherwise lead to throttling when the partition's throughput capacity is exceeded. DynamoDB scales by splitting partitions based on the partition key's hash, so high cardinality is essential for avoiding throttling under high write volumes.

Answer

Enable DynamoDB Accelerator (DAX) to cache write operations.

Answer

Use a global secondary index (GSI) as the primary index for writes.

Answer

Add a local secondary index (LSI) to the table.

Question 9

A company is deploying a web application on AWS that requires a relational database. The application is read-heavy and expects sudden spikes in traffic. The database must be highly available and perform well under load. Which database configuration meets these requirements?

Accepted Answer

Deploy Amazon RDS in a Multi-AZ configuration and use read replicas to offload read traffic.. It combines Multi-AZ deployment for high availability with read replicas to offload read traffic, addressing both the read-heavy workload and sudden traffic spikes. Multi-AZ ensures automatic failover to a standby instance in a different Availability Zone if the primary fails, while read replicas distribute read queries across multiple copies, reducing load on the primary database and improving performance under spike conditions.

Answer

Use Amazon ElastiCache for Memcached as the primary database.

Answer

Deploy Amazon RDS in a Multi-AZ configuration without read replicas.

Answer

Deploy Amazon RDS in a single Availability Zone with a large instance size.

Question 10

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to store persistent data that must be shared across multiple containers in the same task. Which storage option should the company use?

Accepted Answer

Amazon EFS file system. Amazon EFS provides a shared, persistent, and scalable NFS file system that can be mounted concurrently by multiple containers within the same ECS task using Fargate. EFS supports the NFSv4.1 protocol, enabling simultaneous read/write access from multiple containers, which meets the requirement for shared persistent storage across containers in the same task.

Answer

Amazon S3 bucket mounted using s3fs

Answer

Amazon FSx for Lustre

Answer

Amazon EBS volume

Question 11

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to implement service discovery and load balancing at the application layer. Which TWO services should the company use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map (C) is correct because it provides service discovery for ECS services, allowing microservices to register and discover each other via DNS names or API calls, which is essential for dynamic Fargate tasks. Application Load Balancer (D) is correct because it operates at the application layer (Layer 7) and supports HTTP/HTTPS routing, making it suitable for load balancing microservices traffic. Network Load Balancer (B) is not correct because it works at Layer 4 (TCP/UDP) and does not provide application-layer load balancing. Amazon API Gateway (A) is not correct because it is primarily for exposing APIs to external clients, not for internal service-to-service communication. Amazon Route 53 (E) is not correct because it is a DNS service, not a service discovery or application-layer load balancing solution for ECS tasks.

Answer

Amazon API Gateway

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53

Question 12

A company is designing a cost-effective architecture for a batch processing job that runs nightly. The job can tolerate interruptions and requires significant compute power for a few hours. The company wants to minimize costs. Which TWO strategies should the company use?

Accepted Answer

Use Spot Instances for compute.. Option A is correct because Spot Instances offer up to a 90% discount compared to On-Demand prices and are ideal for fault-tolerant, interruptible batch workloads that can be terminated and resumed without impacting the business. Option C is correct because Auto Scaling dynamically adds capacity only during the few hours the nightly job runs and removes it afterward, so the company pays only for the compute actually needed rather than provisioning for peak capacity 24/7. Together, Spot Instances plus Auto Scaling deliver the lowest cost for a short, interruption-tolerant batch job. Option B is not appropriate because a 1-year Reserved Instance commitment is wasteful for a workload that runs only a few hours per night. Option D is not appropriate because On-Demand pricing is the most expensive per-hour option and provides no cost optimization for interruptible work. Option E is not appropriate because Dedicated Hosts are a premium, compliance-driven offering and are far more costly than needed here.

Answer

Purchase Reserved Instances (RI) for a 1-year term.

Answer

Use On-Demand Instances to ensure availability.

Answer

Use Dedicated Hosts for compliance.

Question 13

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Amazon Kinesis Data Streams ingests real-time streaming data from thousands of IoT devices with low latency, and AWS Lambda can process each record as it arrives via event source mapping. The processed data is then stored in Amazon S3 for analytics, meeting all requirements for ingestion, low-latency processing, and durable storage.

Answer

Amazon SQS, AWS Lambda, Amazon S3

Answer

Amazon Kinesis Data Firehose, Amazon Redshift, Amazon S3

Answer

Amazon MQ, AWS Lambda, Amazon RDS

Question 14

A company is migrating a monolithic application to microservices on Amazon ECS. The application needs to communicate with external partners via HTTPS. The company wants to use mTLS for mutual authentication. Which AWS service should be used to handle the mTLS termination?

Accepted Answer

Application Load Balancer (ALB) with mutual TLS. Application Load Balancer (ALB) supports mutual TLS (mTLS) natively by configuring a trust store on the listener that validates client certificates against a Certificate Authority (CA) bundle you upload. This allows the ALB to terminate the HTTPS connection and perform client certificate authentication before forwarding traffic to the ECS service, meeting the requirement for mTLS termination without custom proxy logic.

Answer

Amazon CloudFront with a custom origin

Answer

Network Load Balancer (NLB) with TLS termination

Answer

Amazon API Gateway HTTP API

Question 15

A company wants to design a cost-effective solution to store infrequently accessed log files for 7 years. The logs are generated daily and must be available for retrieval within 24 hours. Which Amazon S3 storage class should be used?

Accepted Answer

S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the most cost-effective storage class for infrequently accessed data that must be retained for 7 years, with retrieval times of up to 12 hours (within the 24-hour requirement). It offers the lowest storage cost among S3 classes, making it ideal for long-term archival of log files that are rarely accessed.

Answer

S3 One Zone-Infrequent Access

Answer

S3 Intelligent-Tiering

Answer

S3 Standard