SAP-C02 Design for New Solutions Practice Test 28 — 15 Questions

Question 1

A company wants to deploy a containerized web application on AWS. They need to manage container orchestration, automatic scaling, and service discovery. Which AWS services should they use? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Elastic Container Service (ECS). Amazon ECS and Amazon EKS both provide container orchestration, automatic scaling, and service discovery. ECS is a fully managed container orchestration service tightly integrated with AWS, while EKS offers Kubernetes-based orchestration. Both meet the requirements, so options B and C are correct. Lightsail is for simple VMs or containers, not full orchestration. Elastic Beanstalk is a PaaS service that can deploy containers but lacks native container orchestration features.

Answer

Amazon Lightsail

Answer

AWS Elastic Beanstalk

Question 2

A company is designing a multi-region active-active application using Amazon Route 53, Application Load Balancers, and Auto Scaling groups. They need to route users to the closest region with the lowest latency. Which routing policy should they use?

Accepted Answer

Latency routing. (Latency routing) is correct because it routes users to the AWS region that provides the lowest latency, based on real-time latency measurements. This is ideal for multi-region active-active applications where users should be directed to the closest region. Option B (Weighted routing) distributes traffic based on assigned weights, not latency. Option C (Failover routing) is used for active-passive disaster recovery. Option D (Geolocation routing) routes based on the geographic location of the user, not on actual network latency.

Answer

Weighted routing

Answer

Failover routing

Answer

Geolocation routing

Question 3

A company is designing a real-time analytics pipeline for IoT data. They need to ingest millions of messages per second, process them with low latency, and store results in Amazon S3. Which combination of services should they use?

Accepted Answer

Amazon Kinesis Data Streams, Amazon Kinesis Data Analytics, Amazon Kinesis Data Firehose. Kinesis Data Streams ingests high-throughput data, Kinesis Data Analytics processes it in real-time, and Kinesis Data Firehose delivers the results to S3. Option B uses SQS, which is not designed for millions of messages per second, and Lambda may throttle under high load. Option C uses Redshift, which is a data warehouse; while streaming data can be loaded into Redshift, it is not a real-time streaming destination and typically requires Firehose. Option D uses IoT Core for ingestion, but DynamoDB is not optimized for storing large analytical results; S3 would be more appropriate.

Answer

Amazon SQS, AWS Lambda, Amazon S3

Answer

Amazon Kinesis Data Streams, Amazon Redshift, Amazon S3

Answer

Amazon IoT Core, AWS Lambda, Amazon DynamoDB

Question 4

A company wants to provide temporary access to an S3 bucket for external partners. The access must be time-limited and restricted to specific objects. Which AWS service or feature should they use?

Accepted Answer

Presigned URLs. Presigned URLs provide temporary, time-limited access to specific S3 objects without requiring AWS credentials. Option A (bucket policies) apply to all principals and cannot be restricted to specific users or time-limited directly. Option B (CloudFront signed URLs) are used for controlling access to content delivered via CloudFront, not for direct S3 access. Option D (IAM roles) require the user to have AWS credentials and assume the role, which is not suitable for temporary external access.

Answer

S3 bucket policies

Answer

CloudFront signed URLs

Answer

IAM roles

Question 5

A company is designing a new application on AWS that requires high availability and disaster recovery across multiple AWS Regions. The application uses an Amazon RDS for MySQL database. Which TWO strategies should they implement to meet these requirements?

Accepted Answer

Enable automated backups and copy them to another Region.. The correct answers are B and D. Option B enables automated backups of the RDS instance and copies them to another region, allowing point-in-time restoration in a different region for disaster recovery. Option D creates a cross-Region read replica, which serves as a standby database in another region for DR and also offloads read traffic. Option A (manual snapshot) requires manual effort and scheduling, not automated. Option C (S3 cross-Region replication) does not apply to RDS database backups. Option E (Multi-AZ) provides high availability within a single region but not across regions.

Answer

Create a manual snapshot and copy it to another Region.

Answer

Use S3 cross-Region replication for the database.

Answer

Enable Multi-AZ deployment.

Question 6

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. They need to ensure that the application can handle a sudden increase in traffic without losing any data or causing errors. Which THREE strategies should they implement?

Accepted Answer

Use DynamoDB on-demand capacity mode.. To handle sudden traffic spikes without data loss or errors, the company should: Option A (DynamoDB on-demand capacity) automatically scales to handle unpredictable throughput; Option C (DynamoDB auto scaling) adjusts provisioned capacity based on demand; Option E (Lambda reserved concurrency) ensures a baseline of concurrent executions to prevent throttling. Option B (SQS) adds decoupling but is not strictly necessary for this requirement and can introduce latency; Option D (DAX) improves read performance but does not address write scaling or throughput spikes for write-intensive loads.

Answer

Decouple the application with Amazon SQS.

Answer

Use DynamoDB Accelerator (DAX) for caching.

Question 7

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. They need to store session state for the application. Which TWO services can they use for this purpose?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis (option D) is commonly used for session state due to its low latency and in-memory data store capabilities. Amazon DynamoDB (option E) is also suitable for session state as it provides low-latency, scalable, and fully managed NoSQL database. Option A (Amazon EFS) is a file storage service, not ideal for session state. Option B (Amazon RDS) is a relational database, which can be used but is not optimal for high-performance session state. Option C (Amazon S3) is an object store with higher latency, making it unsuitable for real-time session management.

Answer

Amazon EFS

Answer

Amazon RDS

Answer

Amazon S3

Question 8

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from the 'confidential' folder in 'my-bucket' using HTTP (not HTTPS). What will happen?

Accepted Answer

The request is denied because the second statement explicitly denies access when using HTTP.. The Deny statement explicitly denies s3:* actions on the confidential folder when SecureTransport is false (HTTP). Since the first statement allows GetObject for the whole bucket, but the Deny overrides (explicit deny), the request will be denied. Option A (allowed) ignores the Deny. Option B (denied due to first statement) is wrong because first statement allows. Option D (denied due to IP condition) is wrong because the IP condition is only on the Allow statement.

Answer

The request is denied because the second statement denies access from the IP range.

Answer

The request is denied because the first statement only allows from a specific IP range.

Answer

The request is allowed because the first statement allows s3:GetObject.

Question 9

Refer to the exhibit. A solutions architect runs the CLI command and gets the output shown. What does the state 'running' indicate about the instance?

Accepted Answer

The instance is running and has passed its status checks.. The CLI command `aws ec2 describe-instance-status` returns the instance state as 'running' and the instance status as 'ok'. The 'running' state in the output refers to the EC2 instance's lifecycle state, but the question specifically asks what the 'running' state indicates about the instance. In the context of `describe-instance-status`, the 'running' state shown is the instance's lifecycle state, which means the instance is powered on and has passed its initial boot. However, the correct interpretation here is that the instance is running and has passed its status checks (both system status and instance status are 'ok'), as indicated by the full output. Option C is correct because the output shows the instance is in the 'running' state and all status checks have passed.

Answer

The instance is pending.

Answer

The instance is stopped.

Answer

The instance is terminated.

Question 10

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket. After deployment, the bucket is created but objects are not automatically deleted after 30 days as expected. What is the most likely cause?

Accepted Answer

The lifecycle rule only applies to noncurrent versions, not current objects.. The lifecycle rule in the template likely uses `NoncurrentVersionExpirationInDays`, which only applies to noncurrent versions, not current objects. To delete current objects after 30 days, an `ExpirationInDays` rule is needed. Versioning being enabled (option C) is necessary for the noncurrent version expiration to work, but the issue is that current objects are not expiring. The bucket name conflict (option B) would cause a deployment failure, not a lifecycle misconfiguration. Region-specific prefix (option D) is not required for lifecycle rules.

Answer

The bucket name conflicts with an existing bucket.

Answer

Versioning is not enabled on the bucket.

Answer

The lifecycle rule requires a region-specific prefix.

Question 11

A company is designing a new microservices-based application on AWS. They need to decouple services and ensure asynchronous communication. Which AWS service should they use?

Accepted Answer

Amazon SQS. Amazon SQS (Simple Queue Service) is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices. By decoupling the components, SQS allows one service to send messages to a queue, and another service to poll and process those messages independently, ensuring fault tolerance and scalability without requiring both services to be available simultaneously.

Answer

Amazon Kinesis

Answer

AWS Lambda

Answer

Amazon SNS

Question 12

A company is migrating a monolithic application to microservices on AWS. They have identified that some services require high-throughput, low-latency data sharing. Which AWS service should they use for this purpose?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is an in-memory data store that provides microsecond latency and high throughput, making it ideal for data sharing between microservices. Option A is correct. Option B (Amazon RDS) is a relational database, not optimized for low-latency data sharing. Option C (Amazon S3) is object storage with higher latency. Option D (AWS Glue) is an ETL service, not suitable for real-time data sharing.

Answer

Amazon RDS

Answer

Amazon S3

Answer

AWS Glue

Question 13

A company is designing a new application that will process sensitive financial data. They need to ensure that data at rest is encrypted using customer-provided encryption keys (SSE-C) in Amazon S3. Which action is required to enable this?

Accepted Answer

Provide the encryption key in the request headers. SSE-C requires the customer to provide the encryption key in the request headers when uploading or accessing objects. Amazon S3 uses the provided key to encrypt data at rest and then discards the key; the customer is responsible for managing the key lifecycle. This is the only way to enforce customer-provided encryption keys at the object level.

Answer

Use AWS KMS to generate a key

Answer

Enable default encryption on the bucket

Answer

Configure a bucket policy to require SSE-C

Question 14

A company is designing a multi-region active-active application using Amazon DynamoDB. They need to ensure low-latency reads and writes globally. Which DynamoDB feature should they use?

Accepted Answer

Global Tables. DynamoDB Global Tables provide a fully managed, multi-region, multi-active database for low-latency reads and writes globally. Option A (Auto Scaling) adjusts throughput but doesn't enable multi-region replication. Option B (DAX) is an in-memory cache that improves read latency but doesn't handle writes or multi-region. Option C (Streams) captures item-level changes but requires additional setup for cross-region replication. Option D (Global Tables) is the correct feature for active-active multi-region workloads.

Answer

Auto Scaling

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB Streams

Question 15

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?

Accepted Answer

Configure the ALB with an SSL certificate. An Application Load Balancer (ALB) can terminate SSL/TLS by installing a certificate on it, reducing CPU load on backend EC2 instances. Option A (self-signed certificate on each instance) does not offload SSL and is less secure. Option B (NLB with SSL pass-through) does not terminate SSL; it passes encrypted traffic through. Option D (CloudFront) can terminate SSL but is a CDN service, not primarily for SSL offload in this architecture, and adds cost and complexity.

Answer

Install a self-signed certificate on each EC2 instance

Answer

Use a Network Load Balancer (NLB) with SSL pass-through

Answer

Use Amazon CloudFront for SSL termination