SAP-C02 Design for New Solutions Practice Test 29 — 15 Questions

Question 1

A company is designing a new application that will run on Amazon ECS with Fargate. They need to store configuration data and secrets securely. Which services should they use? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is correct because it is purpose-built for securely storing, rotating, and managing secrets such as database credentials and API keys throughout their lifecycle. It integrates natively with Amazon ECS to inject secrets into containers at runtime without exposing them in the task definition or environment variables, meeting the requirement for secure configuration data and secrets.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS KMS

Question 2

A company is designing a new web application with a global user base. They need to improve latency for static content and protect against DDoS attacks. Which services should they use? (Choose THREE.)

Accepted Answer

AWS Shield. AWS Shield (Standard, included by default) provides always-on detection and automatic inline mitigations to protect against common DDoS attacks at Layer 3 and Layer 4. For a global web application, this foundational protection is essential to maintain availability and low latency under attack.

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 3

A company is designing a new data lake on Amazon S3. They need to ensure that data is encrypted at rest and that access is audited. Which services should they use? (Choose TWO.)

Accepted Answer

AWS KMS. AWS KMS provides encryption keys, and AWS CloudTrail logs API calls for auditing. Option C (Amazon GuardDuty) is for threat detection, Option D (Amazon Macie) is for sensitive data discovery, and Option E (AWS Config) is for resource configuration tracking.

Answer

Amazon Macie

Answer

Amazon GuardDuty

Answer

AWS Config

Question 4

A company is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences sudden spikes in traffic. Which AWS service should be used to handle the traffic spikes without losing any requests?

Accepted Answer

Amazon SQS. Amazon SQS can buffer requests during spikes, allowing Lambda to process them at its own pace without dropping any.

Answer

Amazon SNS

Answer

AWS Step Functions

Answer

Amazon Kinesis Data Streams

Question 5

A company is deploying a multi-tier web application on AWS. The application must be highly available across three Availability Zones. The web tier runs on EC2 instances behind an Application Load Balancer (ALB). The application tier runs on EC2 instances behind a Network Load Balancer (NLB). The database tier uses a Multi-AZ RDS instance. To reduce cross-AZ data transfer costs, which design should be implemented?

Accepted Answer

Place web and application tier instances in the same subnets across all three AZs. Option D is correct because placing web and application tier EC2 instances in the same subnets across all three Availability Zones ensures that traffic between the ALB and NLB, as well as between the NLB and application instances, stays within the same AZ whenever possible. This design leverages the ALB's cross-zone load balancing behavior (enabled by default) and the NLB's ability to route traffic to targets in the same AZ, minimizing cross-AZ data transfer costs. AWS charges for data transfer between AZs, so keeping traffic within the same AZ reduces those costs while maintaining high availability across three AZs.

Answer

Use AWS Global Accelerator to reduce data transfer costs

Answer

Place all web tier instances in one AZ and all application tier instances in another AZ

Answer

Use a single AZ for all tiers to avoid cross-AZ traffic

Question 6

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS supports ongoing replication to minimize downtime during migration.

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Answer

AWS Snowball

Question 7

A company is designing a new application that will store sensitive user data in Amazon S3. The data must be encrypted at rest and in transit. The solution must use AWS managed keys and must be compliant with PCI DSS. Which combination of encryption options should be used?

Accepted Answer

SSE-S3 for at-rest encryption and HTTPS for in-transit encryption. Option A is correct because SSE-S3 provides server-side encryption at rest using AWS-managed keys (S3-managed keys), which satisfies the requirement for AWS managed keys. HTTPS ensures encryption in transit, and both are compliant with PCI DSS standards for protecting sensitive data.

Answer

Client-side encryption for at-rest and HTTPS for in-transit

Answer

SSE-KMS for at-rest encryption and HTTP for in-transit encryption

Answer

SSE-C for at-rest encryption and HTTPS for in-transit

Question 8

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to minimize operational overhead and ensure that service discovery is automatically updated when services scale. Which service discovery option should be used?

Accepted Answer

AWS Cloud Map. AWS Cloud Map provides service discovery that automatically updates with service scaling.

Answer

Amazon ECS service connect

Answer

Elastic Load Balancing with internal NLB

Answer

Amazon Route 53 private hosted zones with health checks

Question 9

A company is designing a new application that will process streaming data from IoT devices. The data must be processed in real time and then stored in Amazon S3 for long-term analytics. Which combination of AWS services should be used?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Option D is correct because Amazon Kinesis Data Streams ingests and buffers streaming IoT data in real time, AWS Lambda processes each record as it arrives, and the processed data is written directly to Amazon S3 for durable long-term analytics. This combination provides the low-latency, serverless pipeline required for real-time processing and S3-based storage.

Answer

Amazon Kinesis Data Firehose, Amazon Redshift

Answer

Amazon SQS, AWS Lambda, Amazon RDS

Answer

AWS IoT Core, Amazon DynamoDB

Question 10

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

Accepted Answer

Amazon RDS with read replicas. Amazon RDS with read replicas is the correct choice because the application is read-heavy and requires low latency. Read replicas offload read traffic from the primary database instance, scaling read capacity and reducing latency for read operations by distributing the load across multiple copies of the data.

Answer

Amazon DynamoDB with DAX

Answer

Amazon RDS with Multi-AZ deployment

Answer

Amazon ElastiCache for Redis

Question 11

A company is designing a new application that will run on Amazon EKS. The application must be able to scale based on custom metrics such as number of messages in an SQS queue. Which Kubernetes component should be used to achieve this?

Accepted Answer

Kubernetes Event-Driven Autoscaler (KEDA). Kubernetes Event-Driven Autoscaler (KEDA) is the correct component because it is specifically designed to scale Kubernetes workloads based on external event sources like Amazon SQS queue depth. KEDA acts as a custom metrics adapter that integrates with the Kubernetes Horizontal Pod Autoscaler (HPA), allowing the application to scale pods dynamically based on the number of messages in the SQS queue, which is a custom metric not natively supported by the standard HPA.

Answer

Kubernetes Horizontal Pod Autoscaler (HPA) with Prometheus

Answer

Kubernetes Cluster Autoscaler

Answer

AWS Auto Scaling with target tracking

Question 12

A company is designing a new application that will store and retrieve large files (up to 5 TB). The files must be accessible via HTTPS and must be durable. Which AWS storage service should be used?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it supports objects up to 5 TB in size, provides HTTPS access via RESTful API endpoints, and offers 99.999999999% (11 nines) durability by automatically replicating data across multiple Availability Zones. S3 is purpose-built for storing and retrieving large files over the internet with high durability and scalability.

Answer

Amazon EFS

Answer

AWS Storage Gateway

Answer

Amazon EBS

Question 13

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group. The application must be able to distribute incoming traffic across multiple instances. Which TWO AWS services can be used for this purpose? (Choose TWO.)

Accepted Answer

Network Load Balancer. Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and can distribute incoming traffic across multiple EC2 instances in an Auto Scaling group with extremely low latency and high throughput. It is ideal for applications that require handling millions of requests per second while preserving the source IP address of clients.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 14

A company is designing a new data lake on Amazon S3. The data must be encrypted at rest using envelope encryption with AWS KMS. The company wants to use an AWS managed key that rotates annually. Which THREE components are required for this design? (Choose THREE.)

Accepted Answer

AWS KMS data key. KMS key, data key, and S3 are required for envelope encryption.

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 15

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS database. Which THREE steps are required to secure the database access? (Choose THREE.)

Accepted Answer

Place the Lambda function in a VPC with access to the RDS instance. Option A is correct because placing the Lambda function in the same VPC as the RDS instance allows it to communicate over a private IP address, eliminating exposure to the public internet. This is essential for secure database access, as Lambda functions outside the VPC cannot directly connect to RDS instances that are not publicly accessible.

Answer

Store database credentials in the Lambda function code

Answer

Use a public IP address for the RDS instance