SAP-C02 Design for New Solutions Practice Test 27 — 15 Questions

Question 1

A company is building a serverless data processing pipeline. Data is uploaded to an S3 bucket, which triggers a Lambda function to transform the data and store the result in another S3 bucket. The Lambda function needs to access a VPC-hosted database for enrichment. What is the MOST secure way to allow the Lambda function to access the VPC resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Lambda function to access the VPC and use a VPC endpoint for S3.. It allows the Lambda function to be attached to a VPC, enabling it to access the VPC-hosted database securely over private IP addresses. Additionally, using a VPC endpoint for S3 ensures that data transfer between Lambda and the S3 buckets remains within the AWS network, avoiding public internet exposure and reducing data transfer costs.

Answer

Assign a public IP to the Lambda function and route through an Internet Gateway.

Answer

Use Lambda@Edge to process data at the edge location.

Answer

Place the Lambda function in a public subnet and use a NAT Gateway.

Question 2

A company is designing a new microservices architecture on Amazon ECS with Fargate. Each microservice must be isolated and able to communicate with others only through defined APIs. Which solution provides the BEST isolation and security?

Accepted Answer

Use AWS App Mesh with Envoy sidecars to control traffic between services.. AWS App Mesh with Envoy sidecars provides service-level traffic control, encryption, and observability without modifying application code. It enforces fine-grained routing and security policies (e.g., mTLS, retries, timeouts) between microservices, ensuring isolation and that communication only occurs through defined APIs. This aligns with the microservices principle of strict API boundaries and defense in depth.

Answer

Place all microservices in the same security group and allow all traffic.

Answer

Use an Application Load Balancer per microservice with listener rules.

Answer

Use VPC peering between each microservice's VPC.

Question 3

A company is designing a new application that will store sensitive user data in Amazon S3. Compliance requirements mandate that all data must be encrypted at rest using a key that is managed by the company and rotated automatically every year. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable automatic key rotation.. SSE-KMS with customer managed keys (CMKs) meets the compliance requirements because it allows the company to manage the encryption key lifecycle, including automatic annual rotation. AWS KMS supports automatic key rotation for customer managed keys, which can be configured to rotate every year, satisfying the mandate for company-managed keys with automatic rotation.

Answer

Use client-side encryption with the AWS SDK.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3).

Question 4

A company is designing a new data lake on Amazon S3 using AWS Glue for ETL. The data is partitioned by date and sensitive columns must be masked for non-privileged users. The solution must minimize storage costs and allow different masking policies per user. Which approach should the architect recommend?

Accepted Answer

Use AWS Lake Formation to define column-level permissions and masking policies.. AWS Lake Formation provides native column-level security and dynamic masking policies that can be applied per user or role without duplicating data. This approach minimizes storage costs because the data remains in a single location, and masking is applied at query time based on the requesting principal's permissions, satisfying the requirement for different masking policies per user.

Answer

Create separate S3 buckets for each masking policy and copy data accordingly.

Answer

Use AWS Glue ETL jobs to mask data based on user role at query time.

Answer

Store masked data in separate prefixes in the same bucket and use S3 bucket policies.

Question 5

A company needs to provide temporary, limited-privilege credentials to mobile app users to access AWS resources. Which AWS service should the architect recommend?

Accepted Answer

Use Amazon Cognito with an identity pool to issue temporary credentials.. Amazon Cognito identity pools are designed to provide temporary, limited-privilege AWS credentials to mobile app users. The service authenticates users through a public identity provider (e.g., Amazon, Facebook, Google, or a custom OIDC provider) and then exchanges the resulting identity token for temporary AWS credentials via the AWS Security Token Service (STS). This approach avoids embedding long-term credentials in the mobile app and enforces least-privilege access through IAM roles associated with the identity pool.

Answer

Create IAM users for each mobile user and distribute access keys.

Answer

Use AWS Security Token Service (STS) directly from the mobile app.

Answer

Create an IAM role and have the mobile app assume it directly.

Question 6

A company is designing a new real-time analytics platform that processes streaming data from IoT devices. The data must be ingested, processed with windowed aggregations, and stored in Amazon S3 for long-term analytics. The solution must handle late-arriving data and provide exactly-once processing semantics. Which combination of AWS services should the architect use?

Accepted Answer

Use Amazon Kinesis Data Analytics for Apache Flink to process data from Kinesis Data Streams and output to S3.. Amazon Kinesis Data Analytics for Apache Flink provides built-in support for windowed aggregations, exactly-once processing semantics, and handling late-arriving data via allowed lateness and watermarking. It can output processed results directly to Amazon S3 using a Flink sink, meeting all requirements for a real-time analytics platform.

Answer

Use Amazon Kinesis Data Firehose to ingest data and AWS Glue for processing.

Answer

Use Amazon EMR with Spark Streaming to process data from Kinesis Data Streams.

Answer

Use AWS Lambda to process records from Kinesis Data Streams and store in S3.

Question 7

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

Accepted Answer

Configure the ALB as internet-facing and attach it to multiple Availability Zones.. Option B is correct because an internet-facing Application Load Balancer must be attached to subnets in multiple Availability Zones so it can distribute incoming traffic across those zones and remain resilient if one AZ fails. Option C is correct because the EC2 instances themselves must be launched in at least two Availability Zones; an ALB can only route to targets in the AZs it is enabled for, so placing instances in multiple AZs is what actually makes the application highly available. Option A is wrong because confining all instances to a single AZ creates a single point of failure and defeats the multi-AZ requirement. Option D is wrong because the scenario specifies an Application Load Balancer for a web application, and swapping to an NLB is neither required nor appropriate for HTTP/HTTPS layer-7 routing. Option E is wrong because Elastic IP addresses are not needed for instances behind an ALB; the ALB's nodes handle public addressing, and EIPs do not provide multi-AZ high availability.

Answer

Launch all EC2 instances in a single Availability Zone.

Answer

Use a Network Load Balancer instead of an Application Load Balancer.

Answer

Assign Elastic IP addresses to each EC2 instance.

Question 8

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Accepted Answer

EC2 Spot Instances to reduce compute costs.. Option A is correct because EC2 Spot Instances can cut compute costs by up to 90% versus On-Demand, and since the workload is a fault-tolerant batch job that can be retried, Spot interruptions are acceptable, directly supporting the goal of minimizing cost. Option C is correct because AWS Batch is purpose-built for batch computing: it manages a job queue and a compute environment (which can be backed by Spot Instances), dynamically provisioning resources so there is no idle compute capacity. Option D is correct because Amazon S3 Event Notifications can publish an event (e.g., to Amazon EventBridge, SQS, or Lambda) when a new file lands in the bucket, automatically submitting the batch job and eliminating polling or manual triggering. Option B is not appropriate because Lambda has a maximum execution timeout of 15 minutes, far short of the 2-hour CPU-intensive processing time per file. Option E is not appropriate because an Auto Scaling group with scheduled scaling provisions capacity on a time schedule rather than reacting to file arrivals, which risks idle compute and does not provide the job queue and job management that AWS Batch offers.

Answer

AWS Lambda functions to process each file.

Answer

Auto Scaling group with scheduled scaling policies.

Question 9

A solutions architect attempts to create this stack but receives an error: "Value of property SecurityGroups must be a list of strings". What is the likely cause?

Accepted Answer

The SecurityGroups property should be a list, but the YAML specifies a single reference incorrectly.. The error 'Value of property SecurityGroups must be a list of strings' occurs because the YAML template specifies the SecurityGroups property as a single string (e.g., !Ref MySecurityGroup) instead of a list of strings (e.g., [!Ref MySecurityGroup]). In AWS CloudFormation, the SecurityGroups property for an EC2 instance expects a list of security group IDs or names, even if only one security group is provided. The YAML syntax must wrap the reference in square brackets to form a list, or the template will fail validation.

Answer

The security group ingress rule allows SSH from anywhere.

Answer

There is a circular dependency between the EC2 instance and the security group.

Answer

The AMI ID is invalid.

Question 10

A company is designing a new microservices architecture on AWS. The company wants to use a service mesh to manage service-to-service communication, observability, and security. Which AWS service should the company use?

Accepted Answer

AWS App Mesh. AWS App Mesh is a service mesh that provides application-level networking to manage service-to-service communication, observability (via metrics, logs, and traces), and security (via mTLS and fine-grained access policies) for microservices. It uses the Envoy proxy as a sidecar to intercept traffic, enabling features like traffic splitting, retries, and circuit breaking without modifying application code.

Answer

Amazon API Gateway

Answer

AWS Transit Gateway

Answer

AWS Cloud Map

Question 11

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The company wants to achieve a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 15 minutes. Which solution should the company use?

Accepted Answer

Deploy RDS Read Replicas in another Region and promote them during a disaster.. Cross-Region Read Replicas for Amazon RDS MySQL use asynchronous replication, so they do not guarantee a 5-second RPO; replication lag can vary from seconds to minutes. However, among the options provided, D is the closest fit because the read replica can be promoted to a standalone primary database, and the other options fail to meet the RPO/RTO or are invalid. A strict 5-second RPO would be better served by Amazon Aurora Global Database, but D is the best available choice. Option A is invalid because RDS Multi-AZ DB clusters do not support a standby instance in another Region for MySQL. Options B and C do not meet the RPO/RTO requirements.

Answer

Configure an RDS Multi-AZ DB cluster with a standby instance in another Region.

Answer

Use EC2 Auto Scaling to launch new instances in another Region and use an Application Load Balancer.

Answer

Take automated snapshots of the RDS instance every 5 seconds and copy them to another Region.

Question 12

A company is designing a new application that will run on Amazon EKS. The development team wants to deploy containers in a way that minimizes operational overhead. Which compute option should the company choose?

Accepted Answer

AWS Fargate. AWS Fargate is the correct compute option because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. By using Fargate with Amazon EKS, the development team can deploy containers without worrying about node scaling, patching, or cluster capacity, thereby minimizing operational overhead.

Answer

Amazon EKS managed node groups

Answer

Amazon EC2 instances

Answer

Self-managed EC2 nodes

Question 13

A company is designing a new application that requires low-latency access to a shared dataset across multiple EC2 instances in the same AWS Region. The dataset is updated frequently. Which storage solution should the company use?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones within the same AWS Region. It offers low-latency access and supports frequent updates through its standard storage class, making it ideal for shared datasets that require consistent, low-latency performance.

Answer

Amazon S3

Answer

Amazon EBS with Provisioned IOPS

Answer

Amazon S3 Glacier

Question 14

A company is designing a new CI/CD pipeline for a web application that will be deployed on Amazon ECS. Which AWS service should the company use to build and test the application code?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. For a CI/CD pipeline that requires building and testing application code before deployment to Amazon ECS, CodeBuild is the correct service to perform these build and test actions.

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 15

A company is designing a new database solution for a global e-commerce application. The database must support high read and write throughput with single-digit millisecond latency. The company expects traffic spikes during peak hours. Which TWO AWS services should the company consider?

Accepted Answer

Amazon ElastiCache. Amazon DynamoDB (C) is correct because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale, and it handles high read/write throughput with automatic scaling to absorb peak-hour traffic spikes. Amazon ElastiCache (B) is correct because it provides in-memory caching with sub-millisecond latency using Redis or Memcached, offloading read traffic from the primary database and smoothing bursts during peak hours. Together they fit a global e-commerce workload needing fast, elastic throughput. Amazon DocumentDB (A) is a MongoDB-compatible document database that does not deliver the same single-digit millisecond latency guarantees at scale for this use case. Amazon Aurora (D) and Amazon RDS for MySQL (E) are relational databases that can be fast but are not purpose-built for the extreme, spiky throughput and in-memory caching needs described here.

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon Aurora

Answer

Amazon RDS for MySQL