SAP-C02 Design for New Solutions Practice Test 3 — 15 Questions

Question 1

A financial services company needs to design a solution for storing sensitive customer data that must be encrypted at rest using a customer-managed key stored in AWS Key Management Service (KMS). The data will be accessed by multiple EC2 instances in an Auto Scaling group. The company needs to rotate the key every 90 days and ensure that old encrypted data can still be decrypted. Which key strategy should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a customer-managed CMK and generate a new key every 90 days, re-encrypting all data.. It uses a customer-managed CMK with manual rotation every 90 days, which meets the specific rotation requirement. By generating a new key and keeping the old key enabled, old encrypted data remains decryptable. Option C is incorrect because automatic rotation in AWS KMS has a fixed interval of 365 days, which does not satisfy the 90-day rotation requirement.

Answer

Use AWS CloudHSM to generate a key and store it in a hardware security module.

Answer

Use an AWS managed key for S3 and enable automatic rotation.

Answer

Use a customer-managed CMK and enable automatic key rotation.

Question 2

A company is designing a multi-region disaster recovery solution for a critical application using Amazon RDS for MySQL. They need a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which solution should they choose?

Accepted Answer

Use Amazon RDS with cross-Region read replicas and promote the replica to a primary instance in a disaster.. Amazon RDS for MySQL cross-Region read replicas use asynchronous replication with a typical lag of less than 5 seconds, meeting the RPO requirement. In a disaster, you promote the replica to a standalone primary instance, which takes under 1 minute, satisfying the RTO. This is the only option that provides both sub-5-second RPO and sub-1-minute RTO for RDS MySQL.

Answer

Use Amazon Aurora Global Database.

Answer

Use Amazon RDS with automated backups and restore in another Region.

Answer

Use Amazon RDS Multi-AZ with a standby in a different AWS Region.

Question 3

Which TWO strategies can be used to reduce the cost of Amazon DynamoDB tables for a new application with unpredictable traffic patterns? (Choose two.)

Accepted Answer

Use DynamoDB auto scaling with provisioned capacity.. Option A is correct because DynamoDB auto scaling with provisioned capacity adjusts read and write capacity units automatically based on actual utilization via CloudWatch alarms, so you only provision close to what unpredictable traffic demands and avoid paying for idle capacity. Option E is correct because on-demand capacity mode charges per request with no capacity planning, making it cost-efficient for new applications with unknown or spiky traffic since you pay only for the reads and writes you actually perform. Option B is incorrect because DynamoDB Streams captures item-level changes for event processing and does not reduce write capacity or its cost. Option C is incorrect because global tables add multi-region replication, which increases write and storage costs rather than reducing them. Option D is incorrect because DAX is an in-memory cache that can lower read latency and offload read capacity, but it adds cluster costs and does not address unpredictable write traffic or overall table cost reduction.

Answer

Use DynamoDB Streams to reduce write capacity.

Answer

Use DynamoDB global tables for multi-region replication.

Answer

Use DynamoDB Accelerator (DAX) to reduce read capacity.

Question 4

Which THREE factors should be considered when designing a VPC for a new application that must be compliant with the Payment Card Industry Data Security Standard (PCI DSS)? (Choose three.)

Accepted Answer

Encrypt traffic between VPCs using VPN or AWS PrivateLink.. Option A is correct because PCI DSS requires protecting cardholder data in transit, and encrypting traffic between VPCs with a VPN (IPsec) or AWS PrivateLink ensures inter-VPC communications are not exposed in cleartext. Option C is correct because PCI DSS mandates network segmentation to isolate the cardholder data environment (CDE) from other systems, which is achieved with separate subnets and security groups that enforce least-privilege access. Option E is correct because PCI DSS requires logging and monitoring of access to network resources and cardholder data, and VPC Flow Logs capture IP traffic metadata (source/destination, ports, protocol, accept/reject) for auditing and anomaly detection. Option B is not among the marked correct answers because, while VPC endpoints (Gateway or Interface) keep traffic to AWS services off the public internet, the question asks for the three factors specifically tied to PCI DSS compliance design, and this is a general best practice rather than a PCI DSS-mandated control. Option D is incorrect because using a single Availability Zone reduces resilience and availability; PCI DSS and sound architecture call for redundancy across multiple AZs to protect cardholder data availability.

Answer

Use VPC endpoints to keep traffic within the AWS network.

Answer

Use a single Availability Zone to reduce complexity.

Question 5

A Solutions Architect runs the AWS CLI command shown in the exhibit. Which statement accurately describes the output?

Accepted Answer

The command lists all instances regardless of state.. The AWS CLI command `aws ec2 describe-instances` without any filter returns all EC2 instances in the current region, regardless of their state (running, stopped, terminated, etc.). The `--query` parameter is used correctly to extract specific fields from the JSON output, but it does not filter instances by state. Therefore, the output includes every instance, and option A is correct.

Answer

The command lists instances in JSON format.

Answer

The command lists only running instances.

Answer

The command fails because --query is used incorrectly.

Question 6

A Solutions Architect is reviewing the CloudFormation template snippet shown in the exhibit. What will happen when this template is deployed?

Accepted Answer

The template will create an S3 bucket with versioning enabled.. The CloudFormation template snippet includes the `VersioningConfiguration` property set to `Enabled` within the `AWS::S3::Bucket` resource. This explicitly enables versioning when the stack is deployed. The template also specifies a `BucketName`, so CloudFormation uses that name rather than generating a random one. Option B is incorrect because the bucket name is explicitly provided, not randomly generated. Option C is incorrect because the template will only fail if the bucket name is already taken, but that is not guaranteed. Option D is incorrect because versioning is explicitly enabled.

Answer

The template will create an S3 bucket with a random name.

Answer

The template will fail because the bucket name is not globally unique.

Answer

The template will create an S3 bucket with versioning disabled.

Question 7

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The application needs to store session state. Which AWS service provides a fully managed, highly scalable solution for session state management?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides a fully managed, in-memory data store that is ideal for session state management. Redis offers sub-millisecond latency, built-in replication, and automatic failover, making it highly scalable and durable for session data. The Application Load Balancer can be configured with stickiness (session affinity) to route requests to the same EC2 instance, but using ElastiCache for Redis decouples session state from the compute layer, enabling stateless application tiers and seamless scaling.

Answer

Amazon DynamoDB

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 8

A company is designing a disaster recovery solution that must recover an application in a different AWS Region within 15 minutes of a failure. The application uses an Amazon Aurora MySQL DB cluster. Which combination of strategies will meet the recovery time objective (RTO) while minimizing costs?

Accepted Answer

Configure an Aurora cross-Region replica in the DR Region. Use Amazon Route 53 to fail over DNS.. An Aurora cross-Region replica asynchronously replicates data to a DR Region with minimal performance impact, and you can promote it to a standalone cluster within minutes. Combined with Amazon Route 53 DNS failover, this achieves an RTO under 15 minutes while keeping costs low, as you only pay for the replica storage and minimal compute until failover.

Answer

Deploy a standby Aurora cluster in the DR Region and use synchronous replication.

Answer

Use Aurora Global Database with a secondary cluster in the DR Region.

Answer

Take daily snapshots and restore them in the DR Region using cross-Region snapshot copy.

Question 9

A company wants to decouple a front-end web application from a backend processing service to improve scalability. Which AWS service should be used to send tasks from the web tier to the processing tier?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the front-end web application from the backend processing service. The web tier can send tasks (messages) to an SQS queue, and the processing tier can poll and consume those messages asynchronously, enabling independent scaling of each tier. This pattern is a classic example of a producer-consumer architecture where SQS acts as the buffer between components.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon EventBridge

Answer

Amazon Kinesis Data Streams

Question 10

A company is building a serverless application using AWS Lambda. The function needs to access a private Amazon RDS MySQL database. The Lambda function and the RDS instance are in the same VPC. What is the correct way to configure the Lambda function to connect to the database?

Accepted Answer

Configure the Lambda function to run in the same VPC, subnets, and security group as the RDS instance.. Lambda functions in a VPC must be configured with the same VPC, subnets, and security group as the RDS instance to establish direct network connectivity. By placing the Lambda function in the same security group, you can allow inbound traffic from the security group itself (self-referencing rule) or explicitly open the database port (e.g., 3306 for MySQL) to the Lambda's security group. This ensures traffic stays within the VPC and does not traverse the internet, meeting security and latency requirements.

Answer

Use a NAT Gateway to allow Lambda to access RDS through the internet.

Answer

Assign an IAM role that allows Lambda to access RDS and configure the security group to allow traffic from the Lambda service.

Answer

Attach an Elastic Network Interface (ENI) to the Lambda function in the same subnet as the RDS instance.

Question 11

A company is designing a new application that will be hosted on AWS. The application must be highly available across multiple Availability Zones. Which of the following services provide built-in high availability across AZs? (Choose TWO.)

Accepted Answer

Amazon RDS Multi-AZ. Amazon RDS Multi-AZ (A) is correct because it automatically provisions and maintains a synchronous standby replica in a different Availability Zone, with automatic failover to the standby if the primary fails, providing built-in HA across AZs. Elastic Load Balancing (D) is correct because ELB is inherently distributed across multiple AZs; you enable AZs on the load balancer and it routes traffic to healthy targets in each, providing built-in cross-AZ availability. Amazon EBS volumes (B) are incorrect because a volume is tied to a single AZ and can only be attached to instances in that same AZ, so it does not provide cross-AZ HA by itself. Amazon EC2 instances (C) are incorrect because an instance runs in one AZ; HA across AZs requires you to architect it yourself (e.g., with an Auto Scaling group spanning AZs). Amazon S3 (E) is not the intended answer here because, while S3 is highly durable and replicated across AZs within a Region, the question targets services whose HA design is explicitly about multi-AZ failover for compute/database workloads, and the two marked answers are the standard exam selections.

Answer

Amazon EBS volumes

Answer

Amazon EC2 instances

Answer

Amazon S3

Question 12

A company wants to implement a cost-effective disaster recovery strategy for a production Amazon RDS for PostgreSQL database. The solution must provide a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of less than 15 minutes. Which strategies meet these requirements? (Choose THREE.)

Accepted Answer

Deploy the database in a Multi-AZ configuration.. Option B (Multi-AZ) is correct because a standby in a second Availability Zone provides synchronous replication with near-zero data loss and automatic failover, typically completing in 60–120 seconds, satisfying both the sub-5-minute RPO and sub-15-minute RTO. Option C (manual snapshots copied to another Region) is correct because cross-Region snapshot copies give durable offsite recovery points that can be restored in the target Region, and the copy/restore workflow can be completed within the 15-minute RTO when snapshots are taken frequently enough to meet the 5-minute RPO. Option E (cross-Region read replica) is correct because RDS PostgreSQL cross-Region replicas use asynchronous replication with a typical lag of about one second, keeping RPO well under 5 minutes, and can be promoted to a standalone primary in the DR Region within the RTO window. Option A is not correct because automated backups with PITR are stored in the same Region and do not by themselves provide a cross-Region disaster recovery capability. Option D is not correct because AWS DMS continuous replication is intended for migrations and ongoing data movement, not as a native, low-RTO RDS failover mechanism for a production PostgreSQL database.

Answer

Enable automated backups with point-in-time recovery.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to a target in another Region.

Question 13

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared filesystem for storing user-uploaded documents. The company wants to decouple storage and compute, ensure high durability, and minimize operational overhead. Which AWS service should the company use to replace the shared filesystem?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it provides a highly durable (99.999999999% durability), scalable, and fully managed object storage service that decouples storage from compute. Unlike a shared filesystem, S3 allows multiple compute instances (e.g., EC2, Lambda) to access the same documents via HTTP/HTTPS APIs without needing a mounted filesystem, minimizing operational overhead. It also supports features like versioning, lifecycle policies, and cross-region replication, making it ideal for user-uploaded documents in a migration scenario.

Answer

Amazon EBS

Answer

Amazon EFS

Answer

Amazon FSx for Windows File Server

Question 14

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation in KMS.. SSE-KMS with automatic key rotation provides encryption at rest with minimal operational overhead. AWS KMS automatically rotates the customer master key (CMK) annually, and you can configure a custom rotation period (e.g., 90 days) if needed. This meets the requirement for regular key rotation without manual intervention, unlike SSE-S3 which does not support key rotation, and SSE-C which requires manual key management.

Answer

Use server-side encryption with S3 managed keys (SSE-S3) and enable S3 bucket key rotation.

Answer

Implement client-side encryption using the AWS Encryption SDK and store keys in AWS Secrets Manager.

Answer

Use server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.

Question 15

A media company is building a video transcoding pipeline using AWS Elemental MediaConvert. The source videos are uploaded to an S3 bucket, and the transcoded outputs are stored in another S3 bucket. The company wants to trigger the transcoding job as soon as a new video is uploaded. The pipeline must handle high volumes of uploads and ensure that no upload is missed. Which solution is MOST reliable and scalable?

Accepted Answer

Configure an S3 event notification to directly invoke an AWS Lambda function that starts the MediaConvert job.. S3 event notifications can directly invoke a Lambda function with minimal latency and no intermediate components, making it the simplest and most reliable way to trigger MediaConvert jobs for each upload. S3 event notifications are designed to deliver events with at-least-once delivery semantics, ensuring no upload is missed even under high volumes. This direct integration avoids additional failure points like SNS or SQS, which could introduce delays or require extra configuration for scaling.

Answer

Configure an S3 event notification to publish to an Amazon SNS topic, which triggers an AWS Lambda function that starts the MediaConvert job.

Answer

Use Amazon EventBridge to detect S3 PUT events and route them to a Lambda function.

Answer

Configure an S3 event notification to send events to an Amazon SQS queue, and have a Lambda function poll the queue and start MediaConvert jobs.