SAP-C02 Design for New Solutions Practice Test 29 — 15 Questions

Question 1

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has a relational database with complex queries. The team wants to minimize changes to the existing codebase. Which database migration strategy should be recommended?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon RDS for MySQL or PostgreSQL with read replicas.. Using Amazon RDS with the same database engine (MySQL or PostgreSQL) minimizes code changes, as the application can connect via standard SQL drivers. Read replicas can help with read scaling without altering the codebase. Option B is wrong because Aurora Serverless may require configuration changes and does not necessarily minimize code changes. Option C is wrong because S3 and Athena are not suitable for transactional relational queries and would require significant architectural changes. Option D is wrong because DynamoDB would require schema redesign and application changes to use NoSQL.

Answer

Use Amazon Aurora Serverless to reduce management.

Answer

Store data in Amazon S3 and use Athena for queries.

Answer

Migrate to Amazon DynamoDB for scalability.

Question 2

A company wants to decouple a web application frontend from a backend processing service. The frontend sends jobs that are processed asynchronously. Which AWS service is best suited for this decoupling?

Accepted Answer

Amazon SQS. Amazon SQS is the best choice for decoupling a web application frontend from a backend processing service because it provides a fully managed message queue that allows the frontend to send jobs (messages) asynchronously without waiting for the backend to process them. The backend can poll the queue at its own pace, ensuring reliable, scalable, and fault-tolerant communication between the two components. SQS supports standard queues for high throughput and FIFO queues for exactly-once processing, making it ideal for decoupling asynchronous workloads.

Answer

Amazon SNS

Answer

Amazon Kinesis

Answer

AWS Step Functions

Question 3

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudFront and AWS Shield. Amazon CloudFront provides a global content delivery network (CDN) with low latency by caching content at edge locations worldwide. AWS Shield, specifically Shield Advanced, offers managed DDoS protection against large-scale attacks, including layer 3/4 and layer 7 threats. Together, they meet the requirement for both low-latency content delivery and DDoS mitigation.

Answer

AWS Global Accelerator and Amazon CloudFront

Answer

Amazon Route 53 and AWS Shield

Answer

AWS WAF and Amazon CloudFront

Question 4

A company is designing a new application that will run on EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling strategy should be used?

Accepted Answer

Target tracking scaling policy. Target tracking scaling policy is the correct choice because it automatically adjusts the number of EC2 instances to maintain a specified target metric (e.g., average CPU utilization or request count per target) without manual intervention. This policy uses a built-in metric and dynamically calculates the required capacity to handle sudden traffic spikes, aligning with the requirement for automatic scaling under unpredictable load.

Answer

Manual scaling by operations team

Answer

Simple scaling with a cooldown period

Answer

Scheduled scaling based on historical data

Question 5

A company is designing a data lake on S3 with sensitive data that must be encrypted at rest and audited. Which TWO services should be used? (Choose TWO.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail (C) is correct because it records S3 data events and management events, providing the audit trail required to track who accessed or modified the sensitive objects in the data lake. AWS KMS (D) is correct because it provides customer-managed keys and envelope encryption for S3 objects, satisfying the requirement that data be encrypted at rest with controlled, auditable key usage. SSE-S3 (A) does encrypt objects at rest, but it uses AWS-managed keys with no customer control over key rotation or access policies, so it does not meet the audited key-management requirement. Amazon Macie (B) is a data discovery and classification service that identifies sensitive data but does not itself provide encryption or auditing. Amazon GuardDuty (E) is a threat-detection service that analyzes logs for malicious activity but does not encrypt data or deliver the required audit records.

Answer

S3 Server-Side Encryption (SSE-S3)

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 6

An IAM policy is attached to an IAM user. The policy allows the `s3:PutObject` action on the resource `arn:aws:s3:::my-bucket/uploads/*` with a condition that the request must come from IP address `10.0.1.5`. The user is testing from an IP address `10.0.1.5`. What is the effect of the policy?

Accepted Answer

Allow PutObject in uploads/ only. The attached IAM policy grants permission to perform PutObject on the 'uploads/' prefix, and the IP address condition matches the user's test IP (10.0.1.5). Therefore, the effect is to allow PutObject specifically on objects within the 'uploads/' folder.

Answer

Allow all actions on the bucket

Answer

Allow GetObject because the second statement overrides

Answer

Deny all actions because of IP mismatch

Question 7

A company is designing a multi-tier web application on AWS. The application requires high availability across multiple Availability Zones. Which AWS service should be used to distribute incoming traffic across multiple EC2 instances in different Availability Zones?

Accepted Answer

Application Load Balancer. The Application Load Balancer (ALB) operates at Layer 7 of the OSI model and is designed to distribute incoming HTTP/HTTPS traffic across multiple targets, such as EC2 instances, in different Availability Zones. By registering instances in multiple AZs and enabling cross-zone load balancing, the ALB provides high availability and fault tolerance for the multi-tier web application.

Answer

AWS Global Accelerator

Answer

AWS Direct Connect

Answer

Amazon Route 53

Question 8

A company wants to provide temporary, limited-privilege credentials to its application running on an EC2 instance so that the application can access an S3 bucket. What is the BEST practice for achieving this?

Accepted Answer

Create an IAM role with the necessary permissions and attach it to the EC2 instance. The best practice is to use an IAM role, which provides temporary security credentials via the EC2 instance metadata service (IMDS). The application automatically retrieves these credentials without hardcoding secrets, and the credentials are rotated automatically by AWS. This approach follows the principle of least privilege and eliminates the security risks of long-term access keys.

Answer

Use an S3 bucket policy to allow access from the EC2 instance's public IP

Answer

Create an IAM user and store the credentials in the EC2 instance user data

Answer

Store AWS access keys in the application code

Question 9

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (A) is correct because it is purpose-built to store, rotate, and retrieve secrets such as database credentials and API keys via API calls, which fits managing secrets in a microservices application. AWS Systems Manager Parameter Store (B) is correct because it provides centralized, hierarchical storage for configuration data and secrets, with SecureString parameters encrypted by KMS, and integrates natively with AWS services and applications. AWS AppConfig (C) is correct because it is a feature of Systems Manager designed to create, validate, deploy, and roll back application configuration updates dynamically, which suits managing configuration for microservices. Amazon DynamoDB (D) is not a configuration or secrets management service; it is a NoSQL database, so using it for this purpose would be a custom, non-purpose-built solution. Amazon S3 (E) is object storage and, while it can hold files, it lacks native secret rotation, hierarchical parameter management, and configuration deployment/validation features required here.

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 10

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. The platform must process and store high-velocity data with low latency. Which TWO AWS services should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams (B) is correct because it is purpose-built to ingest high-velocity, real-time streaming data from thousands of producers such as IoT devices, providing low-latency, durable, and scalable stream capture with shards and configurable retention. Amazon Kinesis Data Analytics (C) is correct because it runs continuous SQL or Apache Flink queries directly on streaming data from Kinesis Data Streams, enabling real-time processing and analytics with sub-second latency without managing servers. Together, Kinesis Data Streams handles ingestion and Kinesis Data Analytics handles real-time processing, which matches the platform's low-latency, high-velocity requirements. AWS Lambda (A) is compute for event-driven functions but is not a streaming ingestion or stream-processing engine by itself, so it does not fulfill the ingestion-plus-real-time-analytics pairing. Amazon S3 (D) is object storage designed for durable batch storage, not low-latency stream ingestion or real-time processing. Amazon SQS (E) is a message queue for decoupling applications, not a high-throughput streaming data platform for real-time analytics.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon SQS

Question 11

A company is designing a new microservices architecture on AWS. Each service needs to store and retrieve small amounts of configuration data (under 10 KB per item) with low latency. The data is accessed frequently and must be highly available across multiple Availability Zones. Which AWS service should be used?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, making it ideal for frequently accessed configuration data under 10 KB. It provides built-in high availability and durability by automatically replicating data across three Availability Zones in an AWS Region, meeting the requirement for multi-AZ resilience without manual setup.

Answer

Amazon S3

Answer

Amazon ElastiCache for Memcached

Answer

Amazon RDS for MySQL

Question 12

A company is designing a new data lake on AWS. The data lake must support SQL queries using Amazon Athena and also allow Amazon SageMaker to access training data. The solution must minimize storage costs for infrequently accessed data while providing immediate access when needed. Which storage tier should be used for the data lake?

Accepted Answer

Amazon S3 Intelligent-Tiering. Amazon S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, optimizing storage costs without compromising performance. This meets the requirement for infrequently accessed data to be cost-effective while still providing immediate access for Athena queries and SageMaker training, as data in the archive instant access tier can be retrieved within milliseconds.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Standard

Answer

Amazon S3 One Zone-Infrequent Access

Question 13

A company is designing a web application that must handle sudden spikes in traffic. The application runs in a VPC and uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The solution must be cost-effective for variable traffic patterns. Which scaling strategy should be used?

Accepted Answer

Target tracking scaling policy based on average CPU utilization. Target tracking scaling policy is the correct choice because it automatically adjusts the desired capacity of the Auto Scaling group to maintain a target metric (e.g., average CPU utilization at 50%) without requiring manual thresholds or step adjustments. This policy is ideal for variable traffic patterns as it dynamically scales in response to real-time demand, optimizing cost by adding or removing instances only as needed.

Answer

Simple scaling with step adjustments

Answer

Scheduled scaling

Answer

Manual scaling

Question 14

A company is designing a solution to capture changes from an Amazon RDS database and stream them to a data lake. Which AWS service should be used to capture database changes in real time?

Accepted Answer

AWS Database Migration Service (DMS) with change data capture (CDC). AWS DMS with change data capture (CDC) is the correct service because it is specifically designed to capture ongoing changes from source databases (including Amazon RDS) in near real time and replicate them to targets like Amazon S3 (data lake). DMS reads the database transaction logs (e.g., MySQL binlog, PostgreSQL WAL) to capture inserts, updates, and deletes without requiring application-level polling or custom code, making it the most appropriate managed solution for streaming database changes to a data lake.

Answer

AWS Glue with streaming ETL

Answer

AWS Lambda with database polling

Answer

Amazon Kinesis Data Streams with a custom producer

Question 15

A company is designing a new microservices application using Amazon ECS with Fargate. The services need to communicate securely within the VPC. Which approach should be used for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that integrates natively with Amazon ECS and Fargate. It allows microservices to register themselves with DNS-based or API-based service endpoints, enabling dynamic, secure communication within the VPC without requiring manual IP management or external DNS configuration.

Answer

Amazon Route 53 private hosted zones with health checks

Answer

VPC peering connections between services

Answer

Application Load Balancer with path-based routing