SAP-C02 Design for New Solutions Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from the 'confidential' folder in 'my-bucket' using HTTP (not HTTPS). What will happen?

Accepted Answer

The request is denied because the second statement explicitly denies access when using HTTP.. Option C is correct because the Deny statement explicitly denies s3:* actions on the confidential folder when SecureTransport is false (HTTP). Since the first statement allows GetObject for the whole bucket, but the Deny overrides (explicit deny), the request will be denied. Option A (allowed) ignores the Deny. Option B (denied due to first statement) is wrong because first statement allows. Option D (denied due to IP condition) is wrong because the IP condition is only on the Allow statement.

Answer

The request is denied because the second statement denies access from the IP range.

Answer

The request is denied because the first statement only allows from a specific IP range.

Answer

The request is allowed because the first statement allows s3:GetObject.

Question 2

Refer to the exhibit. A solutions architect runs the CLI command and gets the output shown. What does the state 'running' indicate about the instance?

Accepted Answer

The instance is running and has passed its status checks.. The CLI command `aws ec2 describe-instance-status` returns the instance state as 'running' and the instance status as 'ok'. The 'running' state in the output refers to the EC2 instance's lifecycle state, but the question specifically asks what the 'running' state indicates about the instance. In the context of `describe-instance-status`, the 'running' state shown is the instance's lifecycle state, which means the instance is powered on and has passed its initial boot. However, the correct interpretation here is that the instance is running and has passed its status checks (both system status and instance status are 'ok'), as indicated by the full output. Option C is correct because the output shows the instance is in the 'running' state and all status checks have passed.

Answer

The instance is pending.

Answer

The instance is stopped.

Answer

The instance is terminated.

Question 3

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket. After deployment, the bucket is created but objects are not automatically deleted after 30 days as expected. What is the most likely cause?

Accepted Answer

The lifecycle rule only applies to noncurrent versions, not current objects.. Option C is correct because the lifecycle rule only expires noncurrent versions, not current objects. To delete current objects, need an ExpirationInDays rule. Option A (versioning not enabled) is wrong because versioning is enabled. Option B (bucket name conflict) would cause stack creation failure, not lifecycle issue. Option D (region not specified) is irrelevant.

Answer

The bucket name conflicts with an existing bucket.

Answer

Versioning is not enabled on the bucket.

Answer

The lifecycle rule requires a region-specific prefix.

Question 4

A company is designing a new microservices-based application on AWS. They need to decouple services and ensure asynchronous communication. Which AWS service should they use?

Accepted Answer

Amazon SQS. Amazon SQS is a fully managed message queuing service that enables decoupling of application components. Option A (Amazon SNS) is for pub/sub messaging, Option C (Amazon Kinesis) is for real-time streaming, and Option D (AWS Lambda) is for serverless compute.

Answer

Amazon Kinesis

Answer

AWS Lambda

Answer

Amazon SNS

Question 5

A company is migrating a monolithic application to microservices on AWS. They have identified that some services require high-throughput, low-latency data sharing. Which AWS service should they use for this purpose?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis provides an in-memory data store with microsecond latency, ideal for high-throughput data sharing. Option A (Amazon RDS) is a relational database, Option C (Amazon S3) is object storage, and Option D (AWS Glue) is an ETL service.

Answer

Amazon RDS

Answer

Amazon S3

Answer

AWS Glue

Question 6

A company is designing a new application that will process sensitive financial data. They need to ensure that data at rest is encrypted using customer-provided encryption keys (SSE-C) in Amazon S3. Which action is required to enable this?

Accepted Answer

Provide the encryption key in the request headers. SSE-C requires the customer to provide the encryption key in the request headers when uploading or accessing objects. Amazon S3 uses the provided key to encrypt data at rest and then discards the key; the customer is responsible for managing the key lifecycle. This is the only way to enforce customer-provided encryption keys at the object level.

Answer

Use AWS KMS to generate a key

Answer

Enable default encryption on the bucket

Answer

Configure a bucket policy to require SSE-C

Question 7

A company is designing a multi-region active-active application using Amazon DynamoDB. They need to ensure low-latency reads and writes globally. Which DynamoDB feature should they use?

Accepted Answer

Global Tables. DynamoDB Global Tables provide a fully managed, multi-region, multi-active database. Option B (DAX) is a caching layer, Option C (Auto Scaling) adjusts throughput, and Option D (Streams) captures changes.

Answer

Auto Scaling

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB Streams

Question 8

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?

Accepted Answer

Configure the ALB with an SSL certificate. ALB can terminate SSL/TLS by installing a certificate on it. Option B (NLB) does not support SSL termination natively, Option C (CloudFront) is a CDN, and Option D (self-signed certificate) is less secure and not recommended for production.

Answer

Install a self-signed certificate on each EC2 instance

Answer

Use a Network Load Balancer (NLB) with SSL pass-through

Answer

Use Amazon CloudFront for SSL termination

Question 9

A company is designing a new application that will use Amazon RDS for PostgreSQL. They need to implement read replicas to offload read traffic. However, they are concerned about replication lag affecting read consistency. Which action would minimize replication lag?

Accepted Answer

Use instance types with higher network performance. Using db.r5.large instance types with higher network bandwidth reduces replication lag. Option B (Multi-AZ) is for high availability, not read replicas. Option C (increasing storage) does not directly affect lag. Option D (using encrypted endpoints) does not impact lag.

Answer

Increase the allocated storage on the primary instance

Answer

Use an encrypted connection between the primary and replica

Answer

Enable Multi-AZ on the primary instance

Question 10

A company is designing a serverless application using AWS Lambda. The function needs to access a VPC resource. What is the correct way to configure this?

Accepted Answer

Assign the Lambda function to the VPC and configure a security group. Lambda functions must be attached to a VPC and assigned a security group to access resources within the VPC, such as an RDS database or an Elasticache cluster. This configuration creates an elastic network interface (ENI) in the VPC, allowing the function to communicate with VPC resources via private IP addresses. The security group acts as a virtual firewall to control inbound and outbound traffic for the Lambda function.

Answer

Attach an Internet Gateway to the VPC

Answer

Set up a VPC peering connection

Answer

Configure a NAT Gateway in the public subnet

Question 11

A company is designing a new application to store and retrieve user profile pictures. The images will be accessed frequently and must be served with low latency. Which storage solution should they use?

Accepted Answer

Amazon S3. Amazon S3 is ideal for storing and serving static content like images with low latency. Option B (Amazon EBS) is block storage for EC2, Option C (Amazon EFS) is file storage, and Option D (Amazon RDS) is a relational database.

Answer

Amazon EBS

Answer

Amazon EFS

Answer

Amazon RDS

Question 12

A company is designing a new application that will process streaming data from IoT devices. They need to ingest data in real time and apply transformations before storing it in Amazon S3. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) is the correct choice because the question explicitly requires applying transformations to streaming data in real time before storing it in Amazon S3. Kinesis Data Analytics allows you to run SQL or Apache Flink applications directly on streaming data to perform transformations, aggregations, and filtering, and then output the results to a destination like Amazon S3 via Kinesis Data Firehose.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Answer

AWS Lambda

Question 13

A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

Accepted Answer

No, because the request is not using HTTPS.. The Deny statement with aws:SecureTransport=false explicitly denies requests that are not using HTTPS. Even though the Allow statement permits the IP range, the Deny overrides it. Therefore, the request is denied.

Answer

No, because the IP address is not in the allowed range.

Answer

Yes, because the IP address is allowed.

Answer

Yes, because the Allow statement is evaluated first.

Question 14

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

Accepted Answer

Access is denied because the IP is not allowed.. The bucket policy explicitly denies access to all principals except those coming from the allowed IP address range (which does not include 198.51.100.5). In AWS IAM, an explicit deny overrides any allow, so the request from IP 198.51.100.5 is denied. Option D is correct because the policy's condition block restricts access to a specific IP range, and the user's IP is not within that range.

Answer

Access is allowed because the Principal is "*".

Answer

Access is denied because the bucket is not public.

Answer

Access is allowed because the policy does not explicitly deny.

Question 15

The above CLI output shows the state of a CloudWatch alarm. The EC2 instance's CPU utilization averaged 85% for the last 10 minutes. What is the alarm state?

Accepted Answer

ALARM. The CLI output indicates that the alarm state is 'ALARM' because the EC2 instance's CPU utilization averaged 85% for the last 10 minutes, which exceeds the alarm threshold (typically set at, for example, 80% for a standard CPU utilization alarm). CloudWatch alarms transition to ALARM when the metric breaches the threshold for the specified evaluation periods, and here the sustained high utilization over the 10-minute window meets that condition.

Answer

OK

Answer

INSUFFICIENT_DATA

Answer

ERROR

SAP-C02 Design for New Solutions Practice Test 28 — 15 Questions

Exhibit

SAP-C02 Design for New Solutions Practice Test 28 — 15 Questions

Exhibit