SAP-C02 Design for New Solutions Practice Test 29 — 15 Questions

Question 1

A company is designing a serverless application using AWS Lambda. The function needs to access a VPC resource. What is the correct way to configure this?

Accepted Answer

Assign the Lambda function to the VPC and configure a security group. Lambda functions must be attached to a VPC and assigned a security group to access resources within the VPC, such as an RDS database or an Elasticache cluster. This configuration creates an elastic network interface (ENI) in the VPC, allowing the function to communicate with VPC resources via private IP addresses. The security group acts as a virtual firewall to control inbound and outbound traffic for the Lambda function.

Answer

Attach an Internet Gateway to the VPC

Answer

Set up a VPC peering connection

Answer

Configure a NAT Gateway in the public subnet

Question 2

A company is designing a new application to store and retrieve user profile pictures. The images will be accessed frequently and must be served with low latency. Which storage solution should they use?

Accepted Answer

Amazon S3. Amazon S3 is ideal for storing and serving static content like images with low latency. Option A (Amazon EBS) is block storage for EC2, Option C (Amazon EFS) is file storage, and Option D (Amazon RDS) is a relational database.

Answer

Amazon EBS

Answer

Amazon EFS

Answer

Amazon RDS

Question 3

A company is designing a new application that will process streaming data from IoT devices. They need to ingest data in real time and apply transformations before storing it in Amazon S3. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) is the correct choice because the question explicitly requires applying transformations to streaming data in real time before storing it in Amazon S3. Kinesis Data Analytics allows you to run SQL or Apache Flink applications directly on streaming data to perform transformations, aggregations, and filtering, and then output the results to a destination like Amazon S3 via Kinesis Data Firehose.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Answer

AWS Lambda

Question 4

A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

Accepted Answer

No, because the request is not using HTTPS.. The Deny statement with aws:SecureTransport=false explicitly denies requests that are not using HTTPS. Even though the Allow statement permits the IP range, the Deny overrides it. Therefore, the request is denied.

Answer

No, because the IP address is not in the allowed range.

Answer

Yes, because the IP address is allowed.

Answer

Yes, because the Allow statement is evaluated first.

Question 5

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

Accepted Answer

Access is denied because the IP is not allowed.. The bucket policy explicitly denies access to all principals except those coming from the allowed IP address range (which does not include 198.51.100.5). In AWS IAM, an explicit deny overrides any allow, so the request from IP 198.51.100.5 is denied. Option D is correct because the policy's condition block restricts access to a specific IP range, and the user's IP is not within that range.

Answer

Access is allowed because the Principal is "*".

Answer

Access is denied because the bucket is not public.

Answer

Access is allowed because the policy does not explicitly deny.

Question 6

The above CLI output shows the state of a CloudWatch alarm. The EC2 instance's CPU utilization averaged 85% for the last 10 minutes. What is the alarm state?

Accepted Answer

ALARM. The CLI output indicates that the alarm state is 'ALARM' because the EC2 instance's CPU utilization averaged 85% for the last 10 minutes, which exceeds the alarm threshold (typically set at, for example, 80% for a standard CPU utilization alarm). CloudWatch alarms transition to ALARM when the metric breaches the threshold for the specified evaluation periods, and here the sustained high utilization over the 10-minute window meets that condition.

Answer

OK

Answer

INSUFFICIENT_DATA

Answer

ERROR

Question 7

A company is designing a new application that will run on Amazon ECS with Fargate. They need to store configuration data and secrets securely. Which services should they use? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is correct because it is purpose-built for securely storing, rotating, and managing secrets such as database credentials and API keys throughout their lifecycle. It integrates natively with Amazon ECS to inject secrets into containers at runtime without exposing them in the task definition or environment variables, meeting the requirement for secure configuration data and secrets.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS KMS

Question 8

A company is designing a new web application with a global user base. They need to improve latency for static content and protect against DDoS attacks. Which services should they use? (Choose THREE.)

Accepted Answer

AWS Shield. AWS Shield (Standard, included by default) provides always-on detection and automatic inline mitigations to protect against common DDoS attacks at Layer 3 and Layer 4. For a global web application, this foundational protection is essential to maintain availability and low latency under attack.

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 9

A company is designing a new data lake on Amazon S3. They need to ensure that data is encrypted at rest and that access is audited. Which services should they use? (Choose TWO.)

Accepted Answer

AWS KMS. AWS KMS provides encryption keys for data at rest in S3, and AWS CloudTrail logs API calls for auditing purposes. Option A (Amazon Macie) is for sensitive data discovery, Option B (Amazon GuardDuty) is for threat detection, and Option D (AWS Config) is for resource configuration tracking.

Answer

Amazon Macie

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

A company is designing a serverless application using AWS Lambda. The function needs to access a VPC resource. What is the correct way to configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon SQS. Amazon SQS can buffer requests during spikes, allowing Lambda to process them at its own pace without dropping any.

Answer

Amazon SNS

Answer

AWS Step Functions

Answer

Amazon Kinesis Data Streams

Question 11

A company is deploying a multi-tier web application on AWS. The application must be highly available across three Availability Zones. The web tier runs on EC2 instances behind an Application Load Balancer (ALB). The application tier runs on EC2 instances behind a Network Load Balancer (NLB). The database tier uses a Multi-AZ RDS instance. To reduce cross-AZ data transfer costs, which design should be implemented?

Accepted Answer

Place web and application tier instances in the same subnets across all three AZs. Placing web and application tier EC2 instances in the same subnets across all three Availability Zones ensures that traffic between the ALB and NLB, as well as between the NLB and application instances, stays within the same AZ whenever possible. This design leverages the ALB's cross-zone load balancing behavior (enabled by default) and the NLB's ability to route traffic to targets in the same AZ, minimizing cross-AZ data transfer costs. AWS charges for data transfer between AZs, so keeping traffic within the same AZ reduces those costs while maintaining high availability across three AZs.

Answer

Use AWS Global Accelerator to reduce data transfer costs

Answer

Place all web tier instances in one AZ and all application tier instances in another AZ

Answer

Use a single AZ for all tiers to avoid cross-AZ traffic

Question 12

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS supports ongoing replication to minimize downtime during migration.

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Answer

AWS Snowball

Question 13

A company is designing a new application that will store sensitive user data in Amazon S3. The data must be encrypted at rest and in transit. The solution must use AWS managed keys and must be compliant with PCI DSS. Which combination of encryption options should be used?

Accepted Answer

SSE-S3 for at-rest encryption and HTTPS for in-transit encryption. SSE-S3 provides server-side encryption at rest using AWS-managed keys (S3-managed keys), which satisfies the requirement for AWS managed keys. HTTPS ensures encryption in transit, and both are compliant with PCI DSS standards for protecting sensitive data.

Answer

Client-side encryption for at-rest and HTTPS for in-transit

Answer

SSE-KMS for at-rest encryption and HTTP for in-transit encryption

Answer

SSE-C for at-rest encryption and HTTPS for in-transit

Question 14

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to minimize operational overhead and ensure that service discovery is automatically updated when services scale. Which service discovery option should be used?

Accepted Answer

AWS Cloud Map. AWS Cloud Map provides service discovery that automatically updates with service scaling.

Answer

Amazon ECS service connect

Answer

Elastic Load Balancing with internal NLB

Answer

Amazon Route 53 private hosted zones with health checks

Question 15

A company is designing a new application that will process streaming data from IoT devices. The data must be processed in real time and then stored in Amazon S3 for long-term analytics. Which combination of AWS services should be used?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Amazon Kinesis Data Streams ingests and buffers streaming IoT data in real time, AWS Lambda processes each record as it arrives, and the processed data is written directly to Amazon S3 for durable long-term analytics. This combination provides the low-latency, serverless pipeline required for real-time processing and S3-based storage.

Answer

Amazon Kinesis Data Firehose, Amazon Redshift

Answer

Amazon SQS, AWS Lambda, Amazon RDS

Answer

AWS IoT Core, Amazon DynamoDB