SAP-C02 Design for New Solutions Practice Test 28 — 15 Questions

Question 1

A CloudFormation stack output is as above. The company wants to use the SQS queue URL in another stack. Which intrinsic function should be used to reference the queue URL in the second stack?

Accepted Answer

Fn::ImportValue. A is correct because Fn::ImportValue is the only intrinsic function that can reference a cross-stack output value exported via the Export field in a CloudFormation stack. Since the SQS queue URL is an output from one stack and needs to be used in another stack, Fn::ImportValue is required to import the exported value by name.

Answer

Fn::GetAtt

Answer

Fn::Sub

Answer

Fn::Ref

Question 2

An ALB is configured with a target group for HTTP:80. The health check returns a 302 redirect. What is the most likely cause of the unhealthy instances?

Accepted Answer

The application is redirecting health checks to another URL.. The ALB health check expects a 200 OK response from the target. A 302 redirect indicates the application is responding with a redirect (e.g., HTTP to HTTPS or to a login page) instead of a success status. This causes the health check to fail because the ALB does not follow redirects for health checks; it only accepts the configured success codes (default 200).

Answer

The application is returning a 500 Internal Server Error.

Answer

The application is taking too long to respond.

Answer

The security group is blocking health check traffic.

Question 3

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

Accepted Answer

Amazon CloudFront for static content, Amazon API Gateway for the REST API, and AWS Lambda for compute.. It combines Amazon CloudFront for global low-latency delivery of static content, Amazon API Gateway to create and manage the REST API with built-in caching and throttling, and AWS Lambda for serverless compute. This architecture provides high availability, automatic scaling, and global edge caching, meeting the startup's requirements without managing servers.

Answer

Amazon CloudFront for static content, Application Load Balancer for API, and Lambda for compute.

Answer

AWS Lambda@Edge for both static content and API.

Answer

Amazon S3 for static content with Transfer Acceleration, and AWS Lambda for API.

Question 4

A company is migrating a monolithic application to microservices on AWS. The current application uses a single Amazon RDS for PostgreSQL database. To avoid tight coupling, each microservice should have its own database. The company needs to minimize downtime during migration. Which THREE strategies should be used?

Accepted Answer

Design each microservice with its own database.. Option A is correct because giving each microservice its own database enforces the bounded-context isolation that prevents tight coupling, allowing services to evolve schemas and scale independently as required by the migration goal. Option C is correct because AWS DMS supports ongoing (change data capture) replication from the existing RDS for PostgreSQL source to the new per-service databases, keeping them synchronized so cutover can happen with minimal downtime. Option D is correct because the Strangler Fig pattern incrementally routes functionality from the monolith to new microservices, letting the team migrate piece by piece and roll back safely, which directly minimizes downtime and risk. Option B is wrong because a single shared database with separate schemas still creates a shared point of coupling and contention, contradicting the requirement that each microservice own its database. Option E is wrong because deploying all microservices on one large EC2 instance is an anti-pattern that reduces isolation, scalability, and resilience, and does nothing to address database decoupling or migration downtime.

Answer

Use a single shared database with separate schemas for each service.

Answer

Deploy all microservices on a single large EC2 instance.

Question 5

Refer to the exhibit. A CloudFormation template creates an S3 bucket with versioning and a public bucket policy. After deployment, users can access objects in the bucket via the internet. However, the security team requires that all access be logged. What is missing from this configuration?

Accepted Answer

No logging configuration is specified.. The question states that the security team requires all access to be logged, but the CloudFormation template does not include any logging configuration (e.g., server access logs or AWS CloudTrail object-level logging). Without enabling S3 server access logging or delivering logs to a target bucket, no access records are generated, violating the logging requirement. The bucket policy and versioning are irrelevant to the logging gap.

Answer

The bucket is not encrypted.

Answer

The bucket policy does not restrict access to a specific IP range.

Answer

Bucket versioning is not enabled.

Question 6

A company is designing a new application that processes sensitive healthcare data. The application runs on Amazon ECS with Fargate and uses an Application Load Balancer. The company must ensure that all data in transit is encrypted. Which step should be taken?

Accepted Answer

Configure the ALB listener to use HTTPS (port 443) with an SSL certificate.. To encrypt data in transit between clients and the Application Load Balancer (ALB), you must configure the ALB listener to use HTTPS (port 443) with an SSL/TLS certificate. This ensures that all traffic between the client and the load balancer is encrypted using TLS, meeting the requirement for encrypted data in transit for sensitive healthcare data.

Answer

Configure the target group to use HTTP protocol.

Answer

Configure the security group to only allow inbound traffic from approved IPs.

Answer

Use HTTP on port 80 and rely on VPC network ACLs.

Question 7

A company wants to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances. This makes it the ideal choice for persistent storage that must be shared across containers running on different EC2 instances, as it supports the NFSv4.1 and NFSv4.0 protocols and automatically scales storage capacity as files are added or removed.

Answer

EC2 Instance Store

Answer

Amazon S3

Answer

Amazon EBS

Question 8

A company is designing a new microservices architecture using AWS Lambda. Each microservice has its own database. The company wants to securely store database credentials and rotate them automatically. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like Amazon RDS, Redshift, and DocumentDB. It supports built-in rotation with AWS Lambda, ensuring credentials are rotated on a schedule without manual intervention, which directly meets the requirement for automatic rotation in a microservices architecture.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM)

Question 9

A startup is building a web application on AWS that requires a relational database. They expect unpredictable traffic patterns and want to minimize costs while ensuring high availability. Which database solution should they choose?

Accepted Answer

Amazon Aurora Serverless (MySQL-compatible). Amazon Aurora Serverless (MySQL-compatible) is the correct choice because it automatically scales compute capacity based on actual application demand, making it ideal for unpredictable traffic patterns. It provides high availability through multi-AZ storage and automated failover, while minimizing costs by only charging for consumed capacity during active periods.

Answer

Amazon Redshift with concurrency scaling

Answer

Amazon RDS for MySQL with Single-AZ deployment

Answer

Amazon DynamoDB with on-demand capacity

Question 10

A media company is designing a video transcoding pipeline. They receive raw video files in Amazon S3, which need to be transcoded into multiple formats. The pipeline must handle sporadic bursts of uploads and complete processing within 30 minutes for each video. The cost should be minimized. Which design should they use?

Accepted Answer

Use Amazon S3 event notifications to trigger an AWS Elemental MediaConvert job.. AWS Elemental MediaConvert is a fully managed, serverless video transcoding service designed for high-volume, bursty workloads. It integrates directly with S3 event notifications, scales automatically to handle sporadic uploads, and completes each job within the required 30-minute window. Its pay-per-use pricing minimizes cost by eliminating idle infrastructure, unlike provisioned EC2 clusters or Lambda's 15-minute execution limit.

Answer

Use AWS Lambda with layers containing FFmpeg to transcode videos.

Answer

Provision a cluster of EC2 instances running FFmpeg, with Auto Scaling based on SQS queue depth.

Answer

Use Amazon Elastic Transcoder, which is fully managed and triggers from S3 events.

Question 11

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions. What should they do?

Accepted Answer

Enable sticky sessions on the ALB using duration-based cookies.. Application Load Balancers natively support sticky sessions (session affinity) using duration-based cookies. The ALB generates a cookie (AWSALB) that binds a user's session to a specific target instance for the duration of the cookie's lifetime, ensuring consistent user experience without external dependencies.

Answer

Configure an Amazon CloudFront distribution with session affinity.

Answer

Store session data in Amazon ElastiCache and use a cookie to reference it.

Answer

Use a Network Load Balancer (NLB) with cross-zone load balancing.

Question 12

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Accepted Answer

Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.. Option B is correct because PostgreSQL listens on TCP port 5432, and referencing the web tier's security group as the source in the RDS security group's inbound rule allows only those EC2 instances to reach the database on that port. Option D is correct because placing the web tier instances in a private subnet removes them from direct internet exposure while still allowing outbound access to the RDS endpoint. Option E is correct because setting the RDS instance's 'Publicly accessible' option to 'No' ensures the database receives only a private IP address and cannot be reached from the internet. Option A is wrong because a public subnet would expose the database to internet routing, contradicting the requirement. Option C, while a good credential-management practice, does not control network access or port restrictions and is therefore not part of the required steps.

Answer

Launch the database instance in a public subnet.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Question 13

A company is designing a new static website hosted on Amazon S3. They want to use Amazon CloudFront as a content delivery network (CDN) to serve the website globally with low latency. The website content must be encrypted in transit. Which configurations should they use? (Choose TWO.)

Accepted Answer

Configure the S3 bucket policy to deny requests that do not use HTTPS.. Option C is correct because enforcing an S3 bucket policy with a Deny effect on aws:SecureTransport false ensures that any request reaching the S3 origin (including from CloudFront or direct callers) must use HTTPS/TLS, satisfying encryption in transit at the origin. Option D is correct because setting the CloudFront distribution's viewer protocol policy to redirect HTTP to HTTPS (or HTTPS only) guarantees that all client-to-edge traffic is encrypted with TLS, which is the primary in-transit path for a global static website. Option A is incorrect because AES-256 default encryption is server-side encryption at rest, not in transit. Option B is incorrect because S3 Transfer Acceleration speeds up uploads/downloads using AWS edge locations but does not enforce or provide encryption in transit. Option E is incorrect because CloudFront signed URLs control access/authorization to content, not transport encryption.

Answer

Enable default encryption on the S3 bucket using AES-256.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use CloudFront signed URLs to restrict access.

Question 14

A company has an IAM policy attached to a user as shown in the exhibit. The user is trying to stop an EC2 instance in the us-west-2 region. What will happen?

Accepted Answer

The user cannot stop the instance because the second statement denies all actions in regions other than us-east-1.. IAM policy evaluation follows an explicit deny model: any explicit deny overrides any allow. The second statement uses a `Deny` effect with a `StringNotEquals` condition on `aws:RequestedRegion`, which denies all actions (including ec2:StopInstances) when the request region is NOT us-east-1. Since the user is attempting to stop an EC2 instance in us-west-2, the condition evaluates to true, and the deny applies, blocking the action regardless of the first statement's allow.

Answer

The user cannot stop the instance because the condition checks the request region.

Answer

The user can stop the instance because the first statement allows it.

Answer

The user can stop the instance because the condition applies only to the Deny statement, but the Allow statement is unconditional.

Question 15

A company is designing a new application that requires a relational database with automated backups and multi-AZ redundancy. The database workload is predictable with occasional read replicas for reporting. Which AWS service should be used?

Accepted Answer

Amazon RDS. Amazon RDS is the correct choice because it provides managed relational databases (e.g., MySQL, PostgreSQL, Oracle, SQL Server) with built-in automated backups and Multi-AZ redundancy for high availability. The workload is predictable and requires occasional read replicas for reporting, both of which are natively supported by RDS without the need for complex configuration.

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache